HTTP traffic
Every request the game makes. Capture it, replay it, override the response.
The Web Traffic tab captures HTTP, separately from the Spy tab. A game might fire two hundred remotes a second and make four HTTP calls a minute, so mixing them into one stream hides the HTTP calls. Keeping them apart also means you can leave HTTP capture on permanently, since it hooks the request functions directly and costs almost nothing.
What gets captured#
Two toggles in the toolbar, HTTP and RakNet. Both persist per game and are re-applied when a new client connects.
HTTP covers:
game:HttpGetandgame:HttpPost, with the response- the executor's
request/http_requestglobals, with the response HttpService:RequestAsync,GetAsyncandPostAsync
Each record holds the URL, method, headers, body, status, response body, response size and how long it took.
The async HttpService methods log the request only
RequestAsync, GetAsync and PostAsync yield, and a __namecall hook cannot
yield while it holds its frame. Those calls are logged on the way out and passed
straight through, so their rows have no response body.
RakNet rows are outgoing raw packets rather than HTTP: one every half second at
most, payload truncated to 512 bytes. It needs an executor that exposes a
raknet API.
Replaying a request#
Open a row and press Replay. The request goes out again verbatim and the fresh response is shown next to the original. That is how you find out whether an endpoint is still live, whether a token has expired, or what changes between two calls.
Replay uses the executor's own request function, so it carries the same cookies
and headers the game would send. Copy as request{} gives you the same call as
Lua.
Overriding a response#
The Override / Mock response section of a row, and the mock list in the toolbar, intercept requests by URL and return your own response instead of letting the call go out:
| Field | Meaning |
|---|---|
match | A substring of the URL. The first matching rule wins. |
status | The status code to return |
body | The body to return |
headers | Response headers |
The game receives your response as though the server sent it. This works for the
HttpGet family and for the request family. Each rule has a checkbox, so you
can leave a mock in the list and switch it off.
Replaying a request whose URL matches an active rule returns the mock, which is also how you test that the rule matches what you think it does.
What this is for
Mocking a paywall check, testing how a script handles a 500, or seeing what a game does when its config endpoint returns something unexpected.