Skip to content

v1.6.10

v1.6.10: httpcloak 1.6.10
@sardanioss sardanioss tagged this 14 Aug 16:51 
First published release since 1.6.8 on PyPI, npm and NuGet. On the Go module
proxy it supersedes v1.6.9, which is retracted: that tag was pushed from a
pre-fix commit and proxy.golang.org has it permanently pinned there, serving a
build where TLS verification fails open on HTTP/3.

Highlights

- Chrome 151 across Windows, Linux, macOS and Android, with chrome-latest*
  repointed. Verified byte for byte against real captures over both TCP and
  QUIC. The iOS profile ships as provisional and chrome-latest-ios stays on the
  confirmed 150 build.

- Certificate verification callbacks, so certificate pinning is possible
  (#85). Supplied TLS configuration used to be accepted and then ignored;
  callbacks now run on all three protocols, including HTTP/3, where they
  previously failed open.

- Saving a session no longer quietly weakens its certificate checks. A session
  saved with verification configured now refuses a plain restore rather than
  coming back with the permissive half only.

- Long downloads are no longer cut off after roughly two minutes (#83).

- Response bodies could be silently corrupted under concurrency. Fixed.

- The HTTP/3 handshake now matches a real Chrome capture parameter for
  parameter, and no longer opens a throwaway TCP connection before the request.

- Headers the preset reserves no slot for keep a stable order instead of a
  randomised one, on all three protocols.

- The documented local-proxy pattern applied no fingerprint at all, in every
  language. Requesting an https:// URL through the proxy tunnels past it. All
  guides, readmes and examples are corrected, and .NET gains
  LocalProxy.CreateClient().

Full notes in CHANGELOG.md.
Assets 2
Loading