Skip to content
TonyProxy Docs

WebSocket

TonyProxy captures WebSocket traffic the same way it captures HTTPS — transparently, once the client is pointed at the proxy and trusts the TonyProxy CA. Any HTTP/1.1 101 Switching Protocols upgrade or HTTP/2 Extended CONNECT (RFC 8441) handshake is picked up automatically; no per-app configuration.

An upgraded transaction appears in the list with a WS badge next to its method. Selecting it opens the detail panel with two extra tabs.

Messages tab

Every frame that flows on the socket — in both directions — is decoded, unmasked, decompressed (permessage-deflate), and appended live. Each row shows:

  • Direction — client → server (c2s) or server → client (s2c)
  • Opcode — text, binary, ping, pong, close, or a continuation
  • Size — payload bytes after unmasking and inflating
  • Flags — compressed if the frame arrived DEFLATE-compressed, truncated if the payload exceeded the per-frame cap

A running counter at the top shows the total frames captured for the socket. TonyProxy keeps up to 5,000 frames per direction; once that cap is hit, a warning is shown and new frames are dropped rather than pushing the older ones out. Restart the capture on the socket (reconnect the client) to start a fresh window.

  • All / Held / Edited — a segmented control filters the list. Held shows only frames paused at a breakpoint, Edited shows only frames sent after an interactive edit, All shows everything.
  • Cmd+F — focuses a search field that matches case-insensitively against the rendered payload. Large payloads are matched against a bounded preview so typing stays responsive on chatty sockets.
  • Follow tail — a toggle keeps the list scrolled to the newest frame; turn it off to inspect earlier history without the view jumping.

Payload pane

Selecting a frame opens the payload below the list. Three view modes are available:

  • Payload — text, JSON (with syntax highlighting), or a hex dump for binary. Close frames show the RFC 6455 close code and reason.
  • Protobuf — for binary payloads, a decoded protobuf tree view that walks the wire format field-by-field.
  • Diff — for a frame that was edited at a breakpoint, a side-by-side of the original held payload and the edited payload that was actually sent.

The syntax theme is shared with the HTTP body viewer — change it in one place and both views follow.

Handshake tab

Shows the upgrade request and response exactly as they went on the wire — including Sec-WebSocket-Key, Sec-WebSocket-Accept, negotiated subprotocols, and any permessage-deflate extension parameters. Useful for confirming a client picked up the extension you expected, or for diagnosing a rejected upgrade.

Breakpoints on frames

Live Attach (⚡ Attach in the toolbar of the Messages tab) turns any open socket into a breakpoint target: matching frames pause mid-flight and appear as Held rows. You can edit the payload and let it continue, drop it, or send it as-is. Detach at any time to let the socket resume normally.

See Breakpoints for how rules, resume/drop actions, and auto-forward timeouts work — the WebSocket flavor uses the same model, applied per frame instead of per HTTP message.

Copy and resend

Right-click any frame for:

  • Copy Payload — the rendered text (or hex for binary).
  • Copy as wscat — a wscat -c '…' -x '…' one-liner that reproduces a c2s frame against the same URL.
  • Copy as Python — an asyncio + websockets snippet that connects and (for c2s) sends the frame’s payload.
  • Resend Frame — enqueues the frame’s payload + opcode on the same live socket, in the same direction. Only useful while the socket is still open; a reconnected socket is a new transaction and won’t receive the send.