HTTP replay, proxies, and controlled comparisons

Mechanism

Replaying requests is useful only when the compared messages and session state are understood. Browsers and clients add headers, cookies, redirects, compression, and connection reuse. A proxy can reveal these details but may also transform requests. Keep a raw baseline and vary one field to support a causal claim.

Practical method

Save the method, URL, headers, and body. Disable automatic redirects when inspecting intermediate behavior. Track cookies and anti-CSRF values separately from the tested parameter. Compare response status, stable body markers, and timing across several control requests.

curl -i --max-redirs 0 -H "Content-Type: application/json" \
  --data-binary @request.json https://lab.example/api

Interpreting evidence

A repeatable difference with session state held constant is stronger than one unusual response. Preserve the exact body bytes when testing parsing boundaries or duplicate fields.

Pitfalls and limits

Copying a request can include expired tokens. Client libraries may normalize headers or URLs. Compression and dynamic timestamps make naive full-body comparisons noisy.