Using Conditions and Actions
A rule in Fiddler Everywhere is a feature that enables you to use a condition to match targeted traffic (HTTP requests and responses) and then apply a specific action to modify its original behavior.
The article lists and explains the supported matching conditions and applicable actions while creating a rule with the Rules tab in Fiddler Everywhere. It also covers the specifics of final and non-final actions and their immediate result on the modified traffic.
Conditions
The Rule Builder can add and use single or multiple matching conditions needed to trigger different actions. The conditions are logical structures with different statements whose numbers can vary between two and four. A statement field that handles text (string modifier) is case-insensitive by default (you can use the Aa
button to change them to case-sensitive) and can be auto-completed with suggestions corresponding to the captured sessions.
For more information, refer to the following list.
Condition Value | Field Options | Field Options | Field Options | Usage Description |
---|---|---|---|---|
All Sessions | n/a | n/a | n/a | Matches all captured sessions |
URL | String modifiers | Search value | n/a | Matches a specific keyword in the URL column. |
Host | String modifiers | Search value | n/a | Matches a specific keyword in the Host column. |
Path | String modifiers | Search value | n/a | Matches a specific keyword in the path column. |
Protocol | HTTP or HTTPS | n/a | n/a | Differentiate the traffic based on the used protocol (HTTP vs. HTTPS). |
Method | String modifiers | Search value | n/a | Matches sessions using specific HTTP Method. |
Status Code | String modifiers | Search value | n/a | Matches a specific keyword in the Result column. |
HTTP Version | String modifiers | Search value | n/a | Matches a specific HTTP Version. |
Session Type | Predefined types | n/a | n/a | Matches a session through its type (e.g., WebSocket, gRPC, Aborted, Tunnels, Images, etc.). |
Request Header | Header name | String modifiers | The search value | Matches sessions with specific keyword in the explicitly mentioned Request header column. |
Response Header | Header name | String modifiers | The search value | Matches sessions with specific keyword in the explicitly mentioned Response header column. |
Request Body | String modifiers | Search value | n/a | Matches sessions with specific keyword in the Request Body column. |
Response Body | String modifiers | Search value | n/a | Matches sessions with specific keyword in the Response body. |
Request Cookie | Cookie name | String modifiers | Search value | Matches sessions with specific keyword in the explicitly mentioned Request Cookie. |
Response Cookie | Cookie name | String modifiers | Search value | Matches sessions with specific keyword in the explicitly mentioned Response Cookie. |
Request Body Size | Number modifiers (compares bytes) | Search value | n/a | Matches session with specific Request Body Size. |
Response Body Size | Number modifiers (compares bytes) | Search value | n/a | Matches session with specific Response Body Size. |
Request Time | String modifiers | Search value | n/a | Matches specific date string in the Request Time column. |
Request Date | Date modifiers | Date form | n/a | Matches session executed on a specific date. |
Duration | Number modifiers (compares milliseconds) | Search value | n/a | Matches sessions with specific Duration. |
Client IP | String modifiers | Search value | n/a | Matches session with specific Client IP. |
Remote IP | String modifiers | Search value | n/a | Matches session with specific Remote IP. |
Certificate Information | Field name | String modifiers | Search value | Matches sessions with specific keyword in the explicitly mentioned certificate field. |
TLS Version | String modifiers | Search value | n/a | Matches traffic based on the used TLS Version. |
Process | String modifiers | Search value | n/a | Matches a specific Process ID. |
Comment | String modifiers | Search value | n/a | Matches sessions with specific Comment column. |
Rules Modified | Boolean | n/a | n/a | Matches sessions modified by a rule. |
Magic String | The "magic string" content | n/a | n/a | Uses the legacy Fiddler Classic string literals and regular expressions. |
Actions
When Fiddler Everywhere identifies a request that matches the rule's conditions, it automatically maps it to the action set in the rule. An action field that handles text (string modifier) is case-insensitive by default (you can use the Aa button to change them to case-sensitive) and can be auto-completed with suggestions corresponding to the captured sessions. Note that multiple actions will be executed in their numbered order, and action with the final action type will prevent the execution of all subsequent actions.
Apart from returning files or predefined responses, a rule can perform the following specific actions:
Action name | Field Options | Field Options | Preview box | Usage Description | Action type |
---|---|---|---|---|---|
Mark Session | Choose background color | Choose foreground color | Sample Preview box | Marks the session with selected colors. | Non-final |
Update URL | Value modifiers | New value | n/a | Uses the selected value modifier and the new value to update the current URL. | Non-final |
Update Query String | Query Parameter Key | Value modifiers | New value | Uses the selected value modifier and the new value to update the query parameters. | Non-final |
Update Status Code | n/a | n/a | n/a | Modifies the status code returned by the server while preserving the other data untouched. | Non-final |
Update Request Header | Header Name | Value modifiers | New value | Uses the selected value modifier and the new value to update the request header. | Non-final |
Update Response Header | Header Name | Value modifiers | New value | Uses the selected value modifier and the new value to update the response header. | Non-final |
Update Request Body | Value modifiers | New value | n/a | Uses the selected value modifier and the new value to update the request body. | Non-final |
Update Response Body | Value modifiers | New value | n/a | Uses the selected value modifier and the new value to update the response body. | Non-final |
Update Request Cookies | Cookie Key | Value modifiers | New value | Uses the selected value modifier and the new value to update the cookie value. | Non-final |
Update Response Cookies | Cookie Key | Value modifiers | New value | Uses the selected value modifier and the new value to update the cookie value. | Non-final |
Set Breakpoint | Before Sending a Request or Before Sending a Response | n/a | n/a | Pauses the session before the sending request (to the server) or response (to the client). The action works only for newly established connections. | Non-final. |
Return File | File Picker | n/a | n/a | Returns the picked response file. | Non-final |
Return Manual Response | Text field for creating manual response | n/a | n/a | Returns the manually created response. | Non-final |
Return Predefined Response | Predefined responses | n/a | n/a | Returns the selected predefined response. | Non-final |
Return CONNECT Tunnel | n/a | n/a | n/a | This action should be used when you wish to test a URL, which will not be resolved by your DNS Server. The option is also reffered as "Accept all CONNECTs" | Final |
Do Not Show | n/a | n/a | n/a | Hides the matched session for appearing in Fiddler. When the Do Not Show action is applied, no other actions will be executed. | Final |
Do Not Decrypt | n/a | n/a | n/a | Skips decryption for a matched session and shows only CONNECT tunnels. Only conditions for Host, URL, Process, Client IP, HTTP Version, and Remote IP can be used. The action works only for newly established connections. | Final |
Close Gracefully | n/a | n/a | n/a | This action will close the connection gracefully. | Final |
Close Non Gracefully | n/a | n/a | n/a | This action will close the connection forcefully. | Final |
Delay Request | Number value (milliseconds) | n/a | n/a | Delays the request execution with "n" milliseconds. | Non-final |
Comment | String modifiers | New value | n/a | Action to modify, add, or remove a session comment | Non-final |
Magic String | The "magic string" content | n/a | n/a | Uses the legacy Fiddler Classic string literals and regular expressions. | Non-final |
Final and Non-Final Actions
Rule actions can be divided into final and non-final depending on their behavior and whether their presence will allow our actions and rules to be executed.
When you work with final and non-final actions, take into consideration the following insights:
Final actions prevent the execution of any other rule with lower priority (placed lower in the Rules queue).
Final actions prevent the execution of any other rule with lower priority (placed lower in the Rules queue).
Final actions are valid (as final) only when the rule matches an HTTP(S) session.
If a session matches with conditions that depend on its response (for example, a response body contains "HTML"), then any final action in any rule that matches the session will be ignored. The reason for this behavior is that final actions replace the response. By design, Fiddler is not intended to replace a response that was already received and matched conditions in a rule.
Non-final actions are non-blocking - they will allow actions from any other active rules to execute.
A non-final action can be explicitly made final by checking the "Make this action final" option.
The following table demonstrate what happens when you combine final and non-final actions in one or multiple rules.
Actions Type | Result |
---|---|
Only non-final actions | All matching rules have their actions performed and applied |
Only final actions | When a final action triggers, the execution of the rule immediately stops. No other demoted actions or rules will be executed after that. For example, Do Not Show and Do Not Decrypt are final actions. |
Mix of final and non-final Actions | When a final action triggers, the execution of the rule immediately stops. No other demoted actions or rules will be executed after that. For example, the Do Not Show action will block the execution of the Update Response Body action |
Note that each rule is prioritized in the Rules queue and can be demoted and promoted, which will change the execution order. Final rules won't block other active rules that have higher priority the Rules queue.
For an illustration of this scenario, refer to the following cases:
-
You have a rule with a final action (for example, the Close Gracefully final action).
In this case, the rule containing the final action has higher priority in the Rules queue. When the matching request is made, only the first rule will execute, and other demoted rules will not be triggered.
-
You have a rule with non-final action (for example, the Mark Session action).
In this case, the rule containing the non-final action has higher priority in the Rules queue. When the matching request is made, the non-final action will execute, and then the following demoted rule will be triggered as well. If you add additional rules after the rule that contains the final actions, they won't be executed.