如何在客户端拦截HTTPS响应？
假设我调用了 HTTPS 服务器。服务器向我发送回 http 响应。有没有办法可以改变客户端的http响应？ （即任何javascript..等）
谢谢。
--- 更新 ----
好吧，对于 HTTP 请求，假设 JavaScript 使用 query=123456 进行 ajax 调用。当然，我可以拦截它并在发送出去之前更改query=123456。 （如果我想破解）。
但是，当http响应返回时，我是否可以拦截数据并在数据到达浏览器之前对其进行更改。假设它是 HTTPS。
--- 更多 ---
我正在编写的实际程序需要保护来自服务器的数据。因为 javascript 代码将是公开的（因此任何人都可以注入到他们的页面中），我必须确保从我的服务器发送的响应数据将与 javascript 端收到的响应数据相同。
很抱歉最初的问题不清楚。 :)
Let say, I make a call to a HTTPS server. THe server send me back http response. Is there a way I can change the http response in the client side? (i.e. any javascript..etc)
Thanks.
--- UPDATE ----
Well, for HTTP request, let say a javascript making a ajax call with query=123456. Of course, I can intercept it and change query=123456 before it is sent it out. (if I want to hack).
But, when the http response come back, is it possible that I can intercept the data and change it before it reach the browser. assuming that it is HTTPS.
--- More ---
The actual program I am writing require the data from server be secured. because the javascript code will be public (thus anyone can inject into their page), I have to make sure the response data sent from my server will be the same as the one the javascript side receive it.
sorry for the initial question not being clear. :)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您能做的最好的事情就是确保从服务器发送的数据是正确的。就这样。在客户端，根据定义，所有的赌注都将被取消。如果与服务器的连接受到 SSL 保护，那么任何人都很难篡改数据，但到目前为止并非不可能。 HTTPS 连接的优点之一是可以确认服务器的身份。它以安全锁或绿色地址栏等形式向用户显示。相反，当证书无效时，浏览器会向用户抱怨。不过，完全取决于用户是否注意到或忽略这一切。
JavaScript 可以在客户端上被操纵，也可以通过服务器和客户端之间的中间人攻击来操纵，数据也可以以同样的方式操纵，客户端上的任何东西都无法保证。这就是为什么客户端不应该被委托做任何重要的事情，服务器需要对任何事情拥有最后的发言权。 SSL 可以帮助向用户指示连接是否可信，但不能保证。
The best you can do is make sure the data sent from the server is correct. That's all. On the client side, all bets are off by definition. If the connection to the server is SSL secured, it's harder for anybody to mess with the data, but by far not impossible. One of the advantages of an HTTPS connection is that the identity of the server is confirmed. That's displayed to the user in form of a security lock or a green address bar or whatnot. And conversely, when a certificate is invalid, the browser will complain to the user about it. It's completely up to the user to notice or disregard all that though.
Javascript can be manipulated on the client or by a man-in-the-middle attack between your server and the client, data can be manipulated the same way, there's no guarantee for anything on the client side. Which is why the client should never be entrusted to do anything of importance, the server needs to have the last say in anything. SSL can help indicate to the user whether a connection is trusted or not, but it's no guarantee.
您可以创建代理并让您的流量通过代理。代理必须使用正确的证书“解密”流量，然后“加密”它并按其方式发送。但你为什么要这么做呢？这听起来很恶意。
我不认为改变浏览器的数据会有什么好处，除非你试图欺骗用户。
尝试使用 fiddler 玩一会儿。
You can create a proxy and have your traffic go through the proxy. The proxy would have to, using the proper certificate, "decrypt" the traffic and then "encrypt" it and send it on it's way. But why would you want to? This sounds malicious.
I dont see what good changing data going to the browser is going to do unless you're trying to fool the suer.
Try playing around with fiddler for a bit.