# How to intercept & debug all Java HTTPS

DevFeed: [How to intercept & debug all Java HTTPS](<https://devfeed.tech/articles/how-to-intercept-debug-all-java-https-19067.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/how-to-intercept-debug-java-http/>)

Author: HTTP Toolkit; Tim Perry

Published: 2021-03-17T18:00:00Z

Content type: tutorial

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Java](<https://devfeed.tech/topics/java.md>), [debugging](<https://devfeed.tech/topics/debugging.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Instrumentation](<https://devfeed.tech/topics/instrumentation.md>), [configuration](<https://devfeed.tech/topics/configuration.md>)

Tags: [bytecode](<https://devfeed.tech/tags/bytecode.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [http](<https://devfeed.tech/tags/http.md>), [instrumentation](<https://devfeed.tech/tags/instrumentation.md>), [interception](<https://devfeed.tech/tags/interception.md>), [java](<https://devfeed.tech/tags/java.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

This tutorial explains how to use a Java agent to intercept, inspect, breakpoint, and mock HTTP and HTTPS traffic from JVM processes. It describes redirecting traffic through a proxy, trusting the proxy to decrypt HTTPS, and rewriting bytecode without application code changes or manual configuration.

## Source excerpt

Java and the JVM more generally are widely used for services everywhere, but often challenging to debug and manually test, particularly in complicated microservice architectures. HTTP requests and responses are the core of interactions between these services, and with their external APIs, but they're also often invisible and inaccessible. It's hard to examine all outgoing requests, simulate unusual responses & errors in a running system, or mock dependencies during manual testing & prototyping. Over the last couple of weeks, I've built a Java agent which can do this, completely automatically. It can seize control of all HTTP & HTTPS requests in any JVM, either at startup or attaching later, to redirect them to a proxy and trust that proxy to decrypt all HTTPS, allowing MitM of all JVM traffic. Zero code changes or manual configuration required. This means you can pick any JVM process - your own locally running service, Gradle, Intellij, anything you like - and inspect, breakpoint, and mock all of its HTTP(S) requests in 2 seconds flat. In this article, I want to walk you through the details of how this is possible, so you can understand some of the secret powers of the JVM, learn how to transform raw bytecode for yourself, and build on the examples and source code behind this to build your own debugging & instrumentation tools. If you just want to try this out right now, go download HTTP Toolkit. If you want to know how on earth this is possible, and how you can write code that does the same, read on: What's going on here? In some ways, intercepting all HTTP(S) should be easy: the JVM has standard HTTP proxy and SSL context configuration settings (e.g. -Dhttp.proxy and -Djavax.net.ssl.trustStore) so you could try to configure this externally by setting those options at startup. Unfortunately for you, that doesn't work. Most modern libraries ignore these settings by default, opting to provide their own defaults and configuration interfaces. Even when the library does