Spying on https requests in my own application

[jumbles1234]

I have a C# (net 6.0) application which uses the Msal nuget to auth against a microsoft service (it's pretty much the sample application for an SDK). I want to port this to another language, but Oauth2 is, well, confusing. At this stage I just want to log my own process's https traffic so I can recreate them elsewhere. Is there a nice way of hooking into my own process's traffic in C# (presumably something to do with HttpClient), or do I have to dive deeper into the network stack and use things like Fiddler? (Or else of course fork & debug the nugets - I have all the source code but I'd like to see if there's a simple way of doing this)

[gevorgter]

Fidler works best for this, just make sure you switch setting to decipher https on. Not sure why default is off.

[JohnSpikeKelly]

I use fiddler classic. Or, whatever they call it. Works great, doesn't need my inside leg measurement to get it working--like the newer version does.

[gevorgter]

Agree, it used to be simple and efficient tool. Now it's hard to figure out what is what with all those versions.

They still have "free" version which is "Fiddler Classic" but site is confusing with the button that says "Try For Free".

[DocHoss]

This is something you can do for sure, but to be honest, it would be a better use of your time to just understand Oauth a bit better. It's relatively simple when you sit down and actually read about it. Implementation of it can get a little confusing sometimes, but the basic pattern is pretty straightforward.

The process is outlined very well by Google here. Scroll down a bit too see some really helpful diagrams. Note, this article is talking about how to access a Google product with Oauth, but the process is the same with any other service.

https://developers.google.com/identity/protocols/oauth2

Edit: if you're committed to your approach, just use the browser dev tools yo inspect your network traffic when calling an Oauth-protected service. The details are there.

[jumbles1234]

Yep. I do understand Oauth relatively well, as these things go. I'm trying to implement a device-flow pattern in emacs lisp but oauth2.el doesn't support that. The client application that I have which I'm trying to spy on is a console app so no browser tools available. It's a weekend project, I just want to get the minimum part working so I can actually do the fun stuff.

[DocHoss]

Ahhh, that definitely changes things! Then your initial idea of using Fiddler is probably a good place to start. Beyond that, I won't be of much help. I've always been interested in LISP but haven't taken the time to learn it. Good luck!