Active Traffic Interception

Active Interception empowers you to step between your web application and its server. Instead of just observing network traffic, interception allows you to pause HTTP/HTTPS requests or responses in-flight, inspect their contents, alter parameters, and evaluate how the client or server reacts.

---

How Active Interception Works

When Interception is enabled, hexbuffer acts as a live gatekeeper:

1. Client Sends Request: Your web browser or mobile app submits a form or API call.
2. hexbuffer Pauses Traffic: The request is held in the Interception tab before hitting the remote server.
3. User Inspects & Edits: You can modify headers, cookies, JSON bodies, or query strings.
4. Action Executed: Choose to Forward the modified request, Drop it entirely, or Pass Through remaining traffic.

---

Step-by-Step Usage Guide

1. Enable Interception

Navigate to the Intercept tab in the main sidebar and toggle Intercept is ON.

2. Configure Interception Rules

You don't need to pause every single request. Set up specific match rules to target only what you want to test:

• Intercept requests matching domain api.example.com.
• Intercept requests with specific HTTP methods (e.g., POST or PUT).
• Intercept responses containing error status codes (500 Internal Server Error).

3. Modify Parameters In-Flight

When a paused request appears in the editor:

• Edit request parameters (e.g., change user roles, user IDs, or pricing fields).
• Add or remove HTTP headers (e.g., test missing Authorization tokens).
• Click Forward to transmit the modified request to the server.

4. Intercepting Server Responses

You can also intercept and alter server responses before they reach your browser!

• Change a 403 Forbidden response to a 200 OK to test client UI handling.
• Modify JSON payload response properties to test front-end validation limits.

---

Value & Use Cases

• Backend Validation Testing: Verify if your server properly validates input data even when client-side JavaScript restrictions are bypassed.
• Error Simulation: Drop requests to simulate network timeouts or server failures and verify offline/error recovery in your application.
• Role Permission Audits: Test privilege levels by changing session cookies or auth tokens in transit.

[!WARNING] Remember to Disable Interception: Leaving interception turned on with pending paused requests will cause your browser requests to wait indefinitely until forwarded!