Our application uses open telemetry grpc (logs metrics and traces) which causes fiddler ui to spam server reflection calls when the server does not support server reflection.

Ofter only a short time of capturing there are huge volumes of server reflection calls to the same endpoint making the fiddler UI

Fiddler should:
* Allow bypass of traffic initiated from fiddler.UI (my current workaround is a rule to not show the traffic, but it makes the application flicker since it seems to be displayed and then later removed)
* Allow Server Reflection to be turned off
* Server reflection needs a circuit breaker, if the server do not support reflection DONT retry as fast as you can. at most retry with a few minutes between and only if the server is likely to start supporting it

Also: It would be nice (LOW PRIORITY) if you included default .proto files for opentelemetry opentelemetry-proto/opentelemetry/proto at main · open-telemetry/opentelemetry-proto so it could just work.

Current problems:
* 100 000s of "server reflection calls" making application unresponsive and taking up many GB or RAM

Product: Fiddler Everywhere 8.2.0
Operating system: Windows 11 x64, build 10.0.26300
Installation type: Machine-wide installation under C:\Program Files
Impact: Application cannot start without modifying the user's Windows PowerShell profile

SYMPTOM

Fiddler Everywhere initially hangs indefinitely on the splash screen. After
working around that stage, it gets past the splash screen but remains
indefinitely on the application's loading spinner.

The issue reproduces on two separate Dev Box environments belonging to the
same user. A colleague with an otherwise equivalent environment does not
experience it.

ROOT CAUSE

Fiddler launches two Windows PowerShell commands during startup without
-NoProfile or -NonInteractive:

1. A Get-CimInstance Win32_Process query used to locate stale cleanup/backend
   processes.

2. A Get-WmiObject query for Win32_BIOS, Win32_DiskDrive, and Win32_Processor,
   used to calculate the Telerik machine ID.

The user's Microsoft.PowerShell_profile.ps1 is stored under a OneDrive-
redirected Documents folder and therefore follows the user to both Dev Boxes.
The profile performs interactive initialization that blocks or interferes with
these noninteractive child processes.

The first PowerShell command prevents Fiddler from progressing past:

  Ensure no running cleanup nodejs and cleanup .net processes.

After bypassing the profile for that command, Fiddler starts its .NET backend
but remains on the loading spinner. The second PowerShell command never
completes the Telerik machine-ID lookup, so the Electron main process never
returns config-data to Angular.

ProcMon confirmed that Fiddler launches:

  powershell.exe /c "... Get-CimInstance -className win32_process ..."

and later:

  powershell.exe -nologo -Command "... Get-WmiObject Win32_BIOS ..."

The second-stage electron log reports "Retrieved mid/hmid" but never reports
"Retrieved tmid". The Angular renderer remains waiting for config-data.

WORKAROUND

I added a small guard to Microsoft.PowerShell_profile.ps1 that returns without
loading the interactive profile only when the PowerShell command line contains:

  Get-CimInstance -className win32_process

or:

  Get-WmiObject Win32_BIOS

With those two exact exclusions:

- Fiddler Everywhere fully loads.
- The normal interactive PowerShell profile still works.
- The fix works with the profile synchronized through OneDrive.

EXPECTED BEHAVIOR

Fiddler should start regardless of interactive customization in the user's
PowerShell profile.

RECOMMENDED PRODUCT FIX

Launch both PowerShell subprocesses with:

  -NoProfile -NonInteractive

Also apply a finite timeout, terminate the child process when the timeout is
reached, and log a clear error instead of waiting indefinitely.

For the machine-ID command, treat timeout, unexpected profile output, invalid
JSON, and WMI failure as recoverable and use the existing fallback identifier.

In my company we have been using Fiddler Classic for years now.

We were using Fiddler Classic within VM environments, where the Fiddler settings were already preconfigured.

For this preconfiguration we were using a combination of automatically setting registry keys (e.g. for configuring the "Hosts to be skipped" for traffic capturing), automatic manipulation and replacement of the Fiddler script, and the usage of the "ExecAction" executable.

We would like a way to do all those configurations in an automated, non-UI way for Fiddler Everywhere as well.

For us the following things would need to be automatically configurable, for Fiddler Everywhere to cover the same use cases as Fiddler Classic does so far:

- Manipulating the list of "Hosts to be skipped" for traffic capturing

- Manipulating the maximum amount of sessions to be kept in the "Live Traffic"

- Exporting the Fiddler Root Certificate

- Enabling/Disabling HTTPS traffic capturing

- Enabling/Disabling the "System proxy" mode

- Enabling/Disabling the "Allow remote devices to connect" setting

- Adding/Removing Rules

- Enabling/Disabling existing Rules

Consider adding an option that will enable users to save a preferred set of columns that they can easily apply to multiple snapshots.

This will ease users' work by testing different scenarios based on different sets of snapshots.

Currently (version 6.3.0), a custom column is added to all opened snapshots only during their initial creation. However, to add/remove already created columns in multiple snapshots explicitly, one will have to go through each separate snapshot, which is not convenient and is time-consuming.

Fiddler Classic implements and documents this feature. Is this true for Fiddler Everywhere? Can you provide instructions?

I can tell you what does not work on Windows 11:

• Copying my client certificate to $env:USERPROFILE\Documents\FiddlerCore\ClientCertificate.cer

• Copying my client certificate to $env:USERPROFILE\Documents\Fiddler2\ClientCertificate.cer

• Copying my client certificate to $env:USERPROFILE\.fiddler\ClientCertificate.cer

• Copying my client certificate to $env:USERPROFILE\.fiddler\Certificates\ClientCertificate.cer

Please provide detailed instructions for setting this up. Thank you.

add .proto file doesn’t work

Invalid .proto file (Error: ENOENT: no such file or directory, open 'D:\Learn_develop\Common\src\main\proto\proto\api\services\dino\service\task\proto\api\services\dino\data\task\dino_task_info.proto'). Please try again or upload another file

dino_task_info.proto:

After I am done working with a saved session in Fiddler Everywhere, I need to be sure no trace of it remains on my machine, as it can contain customer/user data.

At the moment, all sessions I open are copied to the following path:

C:\Users\<user>\.fiddler\<fiddler user id>\Snapshots

So, even if I close the tab in Fiddler, close Fiddler, and delete the original file I loaded (say, from my desktop), the data is still on my machine.

The request is that Fiddler cleans this folder up upon exit.

Perhaps this can be a setting in Options, or even some confirm dialog on exit (e.g., what if someone wants to keep some tabs open, although I'd like to avoid an extra confirm upon exit).

Best,
Marin

Consider adding support for managed app configuration through Group Policies.

Currently, Fiddler provides app configuration options through registry keys on Windows. While that works well in most cases, it presents a limitation when using tools like Intune, where it is impossible to reuse a custom security group set in AD. Setting the managed app configurations through group policies will enable administrators to use custom security groups (instead of the predefined groups like Administrators, All, Everyone, etc.).

... Intune can also apply permissions to the Windows Registry, and we can use the standard Windows groups like Everyone, Administrators, etc. but not custom security groups that we've defined in Active Directory; Intune doesn't have access to Active Directory.  We had wanted to create a security group, to enable authorized users to be permitted to modify the restricted settings managed in the registry, but we cannot apply permissions for this group using Intune.

Requested through t.1686216

Hello,
It would be amazing if you could add a Search option for saved requests and Saved Request Folders and Also Sorting saved request folder by Name and Date

Folks,

I've been doing a bunch of OAuth work recently where DPoP is enforced. This makes it difficult to craft requests in the composer, because they need to be signed with the proof of possession token.

It strikes me this could be a feature, allow me, in composer, to provide the access token, proof of possession token and current nonce and generate the right authentication and signature headers.

Barry

 

Currently, the only option to intercept and decrypt secure traffic is to install and trust the Fiddler root CA. However, some applications might use different variations of cert pinning, which can be "solved" by creating and using a self-signed certificate. This would also be a viable option for testers of secured applications (that have access to the actually pinned cert).

Suggestions: provide an option for passing a custom self-signed certificate that Fiddler can use instead of the Fiddler root CA.

Related to https://stackoverflow.com/questions/42236967/change-the-root-signing-certificate-used-by-fiddler

Requested through t.1676901

Is there a way to run a filter across multiple captures (i.e. multiple SAZ files loaded into My Snapshots), as opposed to per individual capture? I'm having difficulty scaling the filtering feature across 100+ captures loaded.

Additionally, is there a way to export the filtered results to CSV/XLS for ease of mass review/searching?

Thanks!

Applications use named pipes on Windows to do interprocess communications in addition to tcp connection on localhost.

Sometimes they run grpc , sometimes json.

It would be great if Fiddler would support listening, replay and editing of those named pipe communications.

Some Applications don't like wildcards.

Battle.net prefers "eu.version.battle.net" and turns down the offered "*.version.battle.net" made by the Telerik CA.

It would be nice if we could optionally change this behaviour to better adapt to the specific needs of an application.

I fire up Fiddler Everywhere on my Mac. Generally, it appears to do nothing.

In further detail, "Stream" and "Decode" can be toggled, but otherwise do nothing. The connections icon has a hover-over describing my host and states I have a network connection. The help icon goes to the very limited documentation via browser. The settings icon pops open the settings dialog, which does appear to save changes, but not impact the "nothing" being done by the application. The capture button and inspectors button appear to do nothing. The main viewing area states "No records available." The area to the right of the main area states "Please, select a single Web Session to inspect." And that is it.

Either I'm doing (or not doing) something dumb, or it just isn't working for me. Any help would be appreciated :)

Mac specs: High Sierra 10.13.6, 2.6GHz i7, 16 GB memory

Fiddler Everywhere is much more advanced than the classic version, but the price is not the only reason why users don't upgrade from the classic version.

 

User Interface

The user interface does not include native components like Classic Fiddler, which clearly degrades performance, reduces usability, complicates the user interface and certainly makes it difficult for new users to use this tool.

Apart from that the interface grouping is quite bad, for example I want to use Composer when monitoring live traffic, but this is not possible, Fiddler Classic has no such problem.

Also, considering user habits, while everyone is familiar with the operating system interface, the Everywhere user interface requires some getting used to.

Some features that are available in Native UI but not in the Fiddler Everywhere UI;

• Drag & Drop Features
• Ability to do other things while monitoring live traffic (Better multitasking)
• Keyboard integration is very bad (As you can see in the gif, the directional keys don't even change the selection, and therefore the delete key doesn't work as it should, and if you press the delete key while selected, it completely removes the selection instead of selecting the next one.)
• Fiddler Everywhere uses its own Context Menu, which is frankly terrible in terms of user habits and ease of use, it really annoys me to see the opening animation of the context menu every time.

I would expect the interface to be more practical in a programme that is constantly and actively used, and I would prefer the interface to be native rather than working with the browser engine.

(UI is the biggest reason why I didn't switch)

 

Missing Features

FiddlerScript and Add Ons support is not available. 

 

General Feedback

Fiddler Everywhere feels like a downgrade, not an upgrade, and I say this as a Fiddler Classic user of over 10 years.
If you were considering releasing a paid version of Fiddler Classic, I would probably subscribe, but not to Fiddler Everywhere.

Currently, the Export > Raw Files option does not work when the session is "Partial Content" (status 206).

Consider providing support for exporting sessions with status 206

Requested through t.1657416

Consider providing automated support for network-isolated applications like metro-style applications. The feature is available in Fiddler Classic through the WinConfig option

Details on how an application can be exempted from the Windows settings are posted here:

https://learn.microsoft.com/en-us/previous-versions/windows/apps/dn640582(v=win.10)?redirectedfrom=MSDN 

https://stackoverflow.com/a/33263253 

 

I am a follower of fiddler classic.  I want to know if Extend Fiddler everywhere  with .NET Code. Because the http response in my web project is encrypted, I need to decrypt it before I can see the plain text. This has been implemented in fiddler classic and it works fine. But I wonder if it can be done in fiddler everywhere as well?

Consider the support of variables and variable environments in Fiddler Everywhere. The base functionality should have:

- Option to create a static variable

- Option to create a dynamic variable (e.g., one populated dynamically from response).

- Options to use variables in Composer, Rules, and Inspectors (e.g. for dynamic population)

- Option to easily access and modify stored variables.

- Option to store variables in different environments (e.g. stage, production, etc.)

- Option to share variables/environments.

+2 Requested from 1640564 and 1640556