WebSocket frame decoding issues

Overview

I’m trying to proxy a websocket connection between my Slack web client (on Chrome) and the Slack servers.

Using the chrome dev tools, I can see JSON serialized text frames being sent back and forth over the socket connection. Eg:

I’ve set up a simple script using the websocket api to log messages as they come through the proxy:

from mitmproxy import ctx, websocket

def websocket_message(flow: websocket.WebSocketFlow) -> None:
    ctx.log.info(flow.messages[-1])

However, as the messages pass through the proxy, only messages I am receiving show up correctly.

Frames that the client is about to send show up as raw binary data instead of the expected serialized json text data.

Here is an excerpt of the logs for the same websocket connection as the image above:

>> send: text message: b'\xaaV*\xa9,HU\xb2\x02Q\x99y\xe9J:J\xc9\x19\x89yy\xa99@!\x173G\x0f\xafPo/G\xa0hf\x8a\x92\x95\xa1\x99\x89\xb9a-\x00'
>> send: text message: b'\xaaV*\xa9,HU\xb2R\xcaM-.NLOU\xd2QJ\xceH\xcc\xcbK\xcd\x01\x8a\xb9\x989zx\x85z{9\x02EKR+J\x80BYi@vf\x8a\x92\x95\xa1\x99\x89\xb9Q-\x00'
<< recv: text message: b'{"ok":true,"reply_to":16472,"ts":"1500471034.628876","text":"jf"}'
>> send: text message: b'\xaaV*\xa9,HU\xb2R*\xc8\xccKW\xd2Q\xcaLQ\xb224317\xae\x05\x00'
<< recv: text message: b'{"type":"pong","reply_to":16473}'
>> send: text message: b'\xaaV*\xa9,HU\xb2R*\xc8\xccKW\xd2Q\xcaLQ\xb224317\xa9\x05\x00'
>> send: text message: b'\xaaV*\xa9,HU\xb2R*\xc9L\xce\xceIU\xd2Q\xcaLQ\xb224317\xad\x05\x00'
<< recv: text message: b'{"type":"pong","reply_to":16474}'
>> send: text message: b'\xaaV*\xa9,HU\xb2R*\xc8\xccKW\xd2Q\xcaLQ\xb224317\xab\x05\x00'
<< recv: text message: b'{"type":"pong","reply_to":16476}'

When I tried proxying the same application with Charles, the frames appeared correctly both ways.

Steps to reproduce the problem:

1. Run mitmproxy with the script provided above
2. Open the Slack web client on Chrome and then open the network pane in dev tools
3. Monitor the network pane and mitmproxy event log for discrepancies in frame encoding

System information

Mitmproxy version: 2.0.2 (release version) Python version: 3.6.2 Platform: Darwin-16.6.0-x86_64-i386-64bit SSL version: OpenSSL 1.1.0f 25 May 2017 Mac version: 10.12.5 (‘’, ‘’, ‘’) x86_64

[hgarrereyn]

Ok, I think the issue is that slack is using permessage deflate compression which isn’t handled by mitmproxy. I used a script to remove Sec-WebSocket-Extensions from the websocket request header and the resulting connection was set up without compression and was decoded properly by mitmproxy.

def request(flow: http.HTTPFlow) -> None:
    flow.request.headers["Sec-WebSocket-Extensions"] = ""

Permessage deflate is outlined here: https://tools.ietf.org/html/draft-ietf-hybi-permessage-compression-28

[fazega]

Thank you, you saved my day !