Master FiddlerScript: Customize Your Fiddler Proxy Workflow

FiddlerScript isn’t just a scripting layer — it’s the engine that transforms Fiddler from a passive HTTP debugging tool into an intelligent, automated proxy tailored to your exact development, testing, or security workflow.

Whether you're automating request rewriting for API testing, injecting custom headers during HTTPS decryption, or building conditional logic to simulate network failures, FiddlerScript gives you full programmatic control over every HTTP(S) transaction flowing through your Fiddler proxy. Unlike generic proxy tools, Fiddler’s extensibility via C#-based rules lets developers leverage real .NET APIs — with zero runtime overhead and deep integration into the core inspection pipeline.

This tutorial walks you through practical, production-ready FiddlerScript techniques — no fluff, no legacy syntax, and all examples tested against Fiddler Classic v5.0+ and Fiddler Everywhere (where supported). You’ll learn how to modify requests/responses in real time, log custom diagnostics, intercept secure traffic intelligently, and scale your automation beyond what the UI alone can offer.

Why Customize Fiddler Behavior with FiddlerScript?

The default Fiddler interface is powerful — but static. Every developer faces scenarios where manual intervention slows down iteration: repeatedly adding Authorization: Bearer <token> to dozens of requests, simulating slow networks for frontend resilience testing, or stripping PII before saving sessions for QA handoff. These tasks become error-prone, repetitive, and unscalable without automation.

FiddlerScript solves this by letting you hook into the request/response lifecycle at precise points — before a request leaves your machine, after a response arrives, or even during HTTPS tunnel establishment. Combined with fiddler debugging workflows and proper https decryption setup, it turns Fiddler into a programmable HTTP observability platform.

Key Benefits You’ll Unlock

Reproducible testing: Eliminate manual header edits across hundreds of requests.
Security-aware automation: Safely rewrite tokens, mask sensitive payloads, or enforce TLS version checks.
CI/CD compatibility: Export and version-control .cs rule files alongside your test suites.
Team scalability: Share standardized rule sets across dev, QA, and security teams.

Getting Started: Locate and Edit the CustomRules.js File

FiddlerScript lives in CustomRules.js — a C# file auto-generated when Fiddler first launches. It’s not JavaScript, despite the .js extension. This is a common source of confusion for new users.

Step-by-step Setup

Launch Fiddler Classic (v5.0.20234.59712 or newer recommended).
Press Ctrl+R or go to Rules > Customize Rules…
Fiddler opens the CustomRules.js file in your default editor (typically Notepad++ or VS Code if configured).
Confirm the file path: %USERPROFILE%\Documents\Fiddler2\Scripts\CustomRules.js

⚠️ Troubleshooting Tip: If editing fails silently, ensure Fiddler isn’t running as Administrator while your editor lacks elevated privileges. Either run both as admin or disable UAC temporarily for setup.

Once open, you’ll see boilerplate code including the OnBeforeRequest and OnBeforeResponse handlers — the two most frequently used entry points for fiddler proxy customization.

Modify Requests & Responses in Real Time

The power of FiddlerScript shines when you intercept and mutate traffic on-the-fly. Here are battle-tested patterns.

Add Custom Headers to All Outgoing Requests

static function OnBeforeRequest(oSession: Session) {
    if (oSession.hostname == "api.example.com") {
        oSession.oRequest.headers.Add("X-Debug-Source", "FiddlerScript-v2");
        oSession.oRequest.headers.Add("X-Request-ID", Guid.NewGuid().ToString());
    }
}

This adds traceability headers only to requests targeting api.example.com. Note: oSession.hostname uses the Host header — not DNS resolution — so it’s fast and reliable.

Rewrite Response Bodies for Local Development

Suppose your frontend expects a /config.json endpoint returning environment-specific flags. Instead of mocking a backend, inject JSON directly:

static function OnBeforeResponse(oSession: Session) {
    if (oSession.uriContains("/config.json") && oSession.responseCode == 200) {
        oSession.utilDecodeResponse(); // Decompress if gzipped
        var body = System.Text.Encoding.UTF8.GetString(oSession.responseBodyBytes);
        var config = Newtonsoft.Json.JsonConvert.DeserializeObject<Dictionary<string, object>>(body);
        config["featureFlags"] = new Dictionary<string, bool> {
            { "newCheckoutFlow", true },
            { "darkModeEnabled", false }
        };
        oSession.responseBodyBytes = System.Text.Encoding.UTF8.GetBytes(
            Newtonsoft.Json.JsonConvert.SerializeObject(config)
        );
        oSession.oResponse.headers.Set("Content-Length", oSession.responseBodyBytes.Length.ToString());
    }
}

✅ Requires Newtonsoft.Json referenced in Fiddler — add via Tools > Fiddler Options > Extensions > Add Reference.

Block or Redirect Specific Endpoints

Need to prevent accidental calls to production payment gateways during local testing?

static function OnBeforeRequest(oSession: Session) {
    if (oSession.hostname.Contains("payment.prod") || 
        oSession.uriContains("/v1/charge")) {
        oSession.responseCode = 403;
        oSession.utilSetResponseBody("{\"error\":\"Blocked by FiddlerScript\"}");
        oSession.oResponse.headers.Set("Content-Type", "application/json");
        return; // Skip actual network call
    }
}

This halts the request entirely — no upstream connection is made. Ideal for fiddler tutorial scenarios involving safe sandboxing.

Automate HTTPS Decryption Logic

HTTPS decryption is foundational for modern fiddler debugging — but raw decrypted traffic can be overwhelming. Use FiddlerScript to filter, annotate, or sanitize secure sessions intelligently.

Log Only Sensitive HTTPS Traffic

static function OnBeforeResponse(oSession: Session) {
    if (oSession.oRequest.pipeClient != null && 
        oSession.oRequest.pipeClient.IsSecure && 
        oSession.uriContains("/auth/token")) {
        
        FiddlerApplication.Log.LogString(
            String.Format("[SECURE TOKEN] {0} → {1} | Status: {2}",
                oSession.oRequest.headers.HTTPMethod,
                oSession.fullUrl,
                oSession.responseCode)
        );
    }
}

This logs only token-related HTTPS transactions — helping auditors or security researchers focus on high-risk flows without noise.

Auto-Strip Sensitive Headers from HTTPS Responses

Even with https decryption enabled, avoid leaking auth tokens in saved SAZ files:

static function OnBeforeResponse(oSession: Session) {
    if (oSession.oResponse.headers.Exists("Set-Cookie")) {
        var cookies = oSession.oResponse.headers.GetValues("Set-Cookie");
        foreach (var cookie in cookies) {
            if (cookie.Contains("auth_token=")) {
                oSession.oResponse.headers.Remove("Set-Cookie");
                break;
            }
        }
    }
}

Debug and Troubleshoot Your Scripts

FiddlerScript errors won’t crash Fiddler — but they’ll fail silently unless you know where to look.

Enable Script Debugging

In Fiddler, go to Rules > Customize Rules…

Scroll to the top of CustomRules.js and uncomment:

// FiddlerObject.UI.Alert("CustomRules.js loaded.");

Save. A popup confirms successful reload.

View Runtime Errors

Check Fiddler’s status bar (bottom-left): “Script compilation failed” means syntax issues.
Open Fiddler’s Log tab, filter for FiddlerScript, and watch for exceptions.
Use FiddlerApplication.Log.LogString("DEBUG: " + oSession.fullUrl); liberally — logs appear in the Log tab and persist across restarts.

Common Pitfalls & Fixes

Issue	Cause	Fix
`OnBeforeRequest` not firing for localhost	Loopback exemption in Windows	Run `CheckLoopback.exe` (included with Fiddler) or use `localhost.fiddler`
HTTPS responses missing body	Gzip/Brotli compression not decoded	Call `oSession.utilDecodeResponse()` before accessing `responseBodyBytes`
Rules ignored after update	Fiddler cached old assembly	Press `Ctrl+R` or go to Rules > Reload Script

Advanced: Build Reusable Rule Modules

Monolithic CustomRules.js files become unwieldy. Modularize using #load directives and separate .cs files.

Create C:\FiddlerRules\AuthRewriter.cs:

public static class AuthRewriter {
    public static void Apply(Session oSession) {
        if (oSession.oRequest.headers.Exists("Authorization")) {
            var auth = oSession.oRequest.headers["Authorization"];
            oSession.oRequest.headers["Authorization"] = 
                auth.Replace("Bearer ", "Bearer ***REDACTED*** ");
        }
    }
}

In CustomRules.js, add:

#load "C:\FiddlerRules\AuthRewriter.cs"
static function OnBeforeRequest(oSession: Session) {
    AuthRewriter.Apply(oSession);
}

This supports team collaboration, Git versioning, and CI linting — turning FiddlerScript into maintainable infrastructure.

Conclusion: From Manual Debugging to Intelligent Automation

FiddlerScript moves you beyond point-and-click http debugging into deterministic, repeatable, and scalable network control. You now know how to:

Intercept and rewrite requests/responses with precision,
Enhance https decryption workflows with smart filtering and sanitization,
Diagnose script failures confidently using Fiddler’s built-in logging,
Structure complex logic across modular, reusable components.

These aren’t theoretical exercises — they’re daily accelerators for API testers validating edge cases, frontend engineers mocking microservices, and security analysts auditing auth flows. The more you invest in mastering FiddlerScript, the less time you’ll spend configuring, clicking, and copying — and the more you’ll spend shipping.

Ready to go deeper? browse Advanced Techniques tutorials for session replay automation, certificate pinning bypass, and performance profiling integrations. Or more tutorials for foundational HTTP debugging workflows. For custom enterprise rule sets or team onboarding, contact us — we build production-grade Fiddler extensions.