Re:MitmProxy2Swagger: Automagically reverse-engineer REST APIs
by devjab on Saturday January 04, 2025 @03:02AM
(#42593287)
Why wouldn’t you add authentication to an API you don’t want others to use?
Re:MitmProxy2Swagger: Automagically reverse-engineer REST APIs
by ssdspoimdsjvv on Saturday January 04, 2025 @09:01AM
(#42594710)
The web app probably authenticates using an API as well, in which case it's trivial to add that to your shadow client as long as you have the credentials.
The API needs to be "public" because the app uses the internet to communicate back to the home server.
The API is not "public" in the sense that the app developers want anybody to use it; they just want their app to use this API. So they don't write publicly accessible documentation about it because they don't want to encourage its use.
A tool like MitmProxy2Swagger lets you run the app and record all of its API calls so that you can use this unadvertised API.