Master Fiddler Composer: Craft & Send Custom HTTP Requests

Fiddler Composer is one of the most underutilized yet powerful tools in the Fiddler proxy toolkit — especially for developers, QA engineers, and security researchers who need precise control over HTTP request structure. Unlike passive inspection or automatic replay, Composer lets you build requests from scratch: define headers, set body content (JSON, XML, form-data), manipulate authentication, test edge cases, and simulate malformed or malicious payloads. When paired with Fiddler’s HTTPS decryption capabilities, it becomes indispensable for end-to-end API testing and debugging encrypted traffic.

This guide walks you through real-world usage of Fiddler Composer — not just how to open it, but how to use it effectively: crafting REST calls, simulating OAuth flows, injecting custom cookies, and troubleshooting common pitfalls like missing headers or TLS handshake failures. Whether you’re validating backend behavior, fuzzing endpoints, or reverse-engineering third-party APIs, mastering Composer transforms Fiddler from a passive observer into an active testing instrument.

Launching and Navigating Fiddler Composer

Composer opens via Rules → Customize Rules (to enable advanced scripting) or more directly: click the Composer tab at the top of Fiddler’s UI (or press Ctrl+R). The interface splits into four key zones:

• Request Builder Pane: Where you define method, URL, headers, and body.
• Auto-Generated Syntax Preview: Shows the raw HTTP message as you type.
• Execute Button (Execute): Sends the request through Fiddler’s proxy engine.
• Response Pane (bottom): Displays status code, headers, and body — identical to the main session list view.

By default, Composer uses HTTP/1.1 and sets User-Agent: Fiddler — but every field is editable. Start simple: enter GET and https://httpbin.org/get, then click Execute. You’ll see a 200 OK response with echoed query parameters. This confirms your environment is ready — including proper HTTPS decryption if targeting secure endpoints.

💡 Pro Tip: If HTTPS requests fail with 502 Tunnel Failure, verify that Fiddler’s root certificate is installed and trusted on your machine — especially on Windows 11 or macOS with strict cert validation.

Building RESTful Requests with Headers and Body

Most modern APIs require specific headers (Content-Type, Authorization, Accept) and structured bodies (JSON, XML). Here’s how to replicate them accurately:

Setting Headers

Click the Headers tab in Composer. Type each header on a new line in Key: Value format:

Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Accept: application/vnd.api+json

Fiddler auto-validates syntax — red highlighting means a malformed header (e.g., missing colon or trailing space). Use Ctrl+Space to trigger autocomplete for common headers (Content-Length, Host, Referer).

Adding Request Bodies

Switch to the Body tab. Select encoding mode:

• Text: For raw JSON, XML, or plain text.
• File: Upload binary files (e.g., images for multipart uploads).
• Form: Auto-generates multipart/form-data with boundary detection.

For a POST to a user creation endpoint:

{
  "name": "Alice Chen",
  "email": "alice@example.com",
  "role": "admin"
}

Ensure Content-Type: application/json is set — otherwise the server may ignore or misparse the payload. Fiddler does not auto-calculate Content-Length; leave it blank and Fiddler injects it automatically upon execution.

Simulating Authentication and Session Context

Composer excels at replicating authenticated workflows without browser dependencies. Two frequent patterns:

Bearer Token Injection

Paste your JWT or API key into the Authorization header. To avoid hardcoding sensitive tokens, use Fiddler’s QuickExec bar (Ctrl+F11) to run scripts like:

!set auth_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Then reference it in Composer using {auth_token} — though note: dynamic variable substitution requires enabling Rules → Customize Rules and adding logic to OnBeforeRequest. For simpler cases, copy-paste remains reliable and auditable.

Cookie-Based Sessions

If your app relies on cookies (e.g., legacy PHP or ASP.NET apps), populate them manually:

Cookie: ASP.NET_SessionId=abc123; csrftoken=xyz789

To extract cookies from a live session: select any captured request in the main grid → right-click → Copy → Cookies. Paste directly into Composer’s Headers pane. This preserves session fidelity when re-testing protected routes — critical for fiddler debugging of login-dependent flows.

Advanced Techniques: Multipart Uploads & Raw TCP

Composer supports complex payloads beyond basic JSON.

Multipart Form Data

Select Body → Form, then click Add File or Add Text Field. Fiddler auto-generates boundaries and correct Content-Type headers. For example:

• Field name: avatar
• File: profile.jpg (binary)
• Field name: metadata
• Text: {"privacy":"private"}

The resulting request includes:

Content-Type: multipart/form-data; boundary=----FiddlerBoundary12345

…and properly encoded parts. No manual boundary management required — a huge time-saver during HTTP debugging of file-upload APIs.

Raw TCP & Custom Protocols

While Composer defaults to HTTP(S), you can force raw TCP by prefixing the URL with tcp:// (e.g., tcp://localhost:8080). This bypasses HTTP parsing entirely and sends bytes as-is — useful for testing gRPC-over-HTTP/2 handshakes, WebSocket upgrade requests, or custom binary protocols. Note: HTTPS decryption won’t apply here — raw TCP sits outside Fiddler’s TLS interception layer.

Troubleshooting Common Composer Issues

Even experienced users hit snags. Here are frequent problems — and how to resolve them:

“502 Tunnel Failure” on HTTPS Requests

This almost always means Fiddler’s root certificate isn’t trusted system-wide. On Windows: open Tools → Options → HTTPS, ensure Decrypt HTTPS traffic is checked, then click Actions → Trust Root Certificate. On macOS: import FiddlerRoot.cer into Keychain Access and set it to Always Trust. Without this, fiddler proxy cannot perform MITM decryption — and Composer fails silently on secure endpoints.

Missing or Incorrect Host Header

Some servers reject requests without an explicit Host header — especially load-balanced or SNI-based deployments. Always include it manually:

Host: api.example.com

Fiddler doesn’t auto-populate Host from the URL if you edit the path or scheme post-entry. Verify it matches the target domain exactly.

Body Not Sent (Empty Payload)

Check two things:

1. The Method dropdown is set to POST, PUT, or another body-accepting verb — GET ignores body content.
2. You’re editing in the Body tab and haven’t accidentally switched back to Headers or Auth before executing.

A quick sanity check: toggle to Raw view in Composer — you should see your body content appear below the headers.

Delayed or Hanging Requests

If Composer hangs after clicking Execute, confirm:

• Target server is reachable (ping or curl works?)
• No firewall or corporate proxy intercepting Fiddler’s outbound connection
• Timeout settings: Tools → Options → Connections → Request Timeout (seconds) — increase from default 30 if testing slow endpoints

Automating Repeated Requests with AutoResponder + Composer

For regression testing or performance validation, combine Composer with Fiddler’s AutoResponder. Example workflow:

1. Capture a known-good request (e.g., POST /api/v1/users with valid JSON)
2. In AutoResponder, add a rule matching that URL and return a static 201 response
3. In Composer, modify the request body (e.g., duplicate email field) and re-execute

This isolates backend logic from network variability — ideal for fiddler tutorial scenarios where repeatability matters more than live service state.

You can also export Composer requests as .saz archives or save them as .fiddler files (via File → Save As) for team sharing or CI integration.

Conclusion: From Observation to Orchestration

Fiddler Composer shifts your role from passive observer to active HTTP orchestrator. It’s not just about sending arbitrary requests — it’s about modeling real-world conditions: malformed input, expired tokens, missing headers, oversized payloads, and protocol edge cases. When integrated with Fiddler’s full ecosystem — including browse Request Modification tutorials, HTTPS decryption, and AutoResponder — Composer becomes the cornerstone of robust API validation.

Key takeaways:

• Always verify HTTPS decryption is enabled and trusted before testing secure endpoints
• Use the Raw view to audit exact byte-level output — critical for debugging encoding issues
• Leverage headers and cookies from live sessions to replicate authenticated contexts
• Combine Composer with AutoResponder for deterministic, repeatable test suites
• Never assume Content-Length — let Fiddler calculate it unless you’re testing length-parsing vulnerabilities

Ready to go deeper? Explore our more tutorials on advanced Fiddler scripting, or dive into request modification techniques like breakpoint-based header injection and response rewriting.