vcr-browser-proxy 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: bdcae55b71027c6f16170d49f146102527ae7ff6dea1438b856794ff6dd54b2f
+  data.tar.gz: fe337550f99f95c929558d21adcdb2bc23a7d776f1ee722a1b64533b67f4afc5
+SHA512:
+  metadata.gz: 5037ca81cf866fa4b2e530e3b60fe5ff1495f1f62e82feac60b28f8faf9e34ea1f0a3c648077814527f9b819e7ff4fcbb0c96c3d6bc25e4809272820299db219
+  data.tar.gz: 1d423730438e11985dfd8b6cf750c3ed06d8f5b44edd881d29e039dfa51c3e9ddfb609808fc38c99397b339f1516a364b4f9f0c66ae21e9d892d4e494f5c6458

data/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## 0.1.0
+
+First release
+
+- Ruby and Chrome CI matrix, coverage reports, gem installation smoke test,
+  README badges, and automated dependency update checks.
+
+- Threaded MITM proxy that re-issues browser requests through Excon, so VCR and
+  WebMock see them.
+- One certificate for every host, with its SPKI for Chrome's allowlist.
+- Host allowlist; everything else gets an empty 204.
+- Upstream connection reuse within a tunnel for idempotent requests, with
+  retries on timeouts and dropped sockets.
+- Chunked request bodies, `HEAD`, bodiless statuses, and a 400 for malformed
+  requests.
+- `RedirectOrigin` and `CrossSiteCookies` rewriters.
+- `VcrBrowserProxy.configure`, `VcrBrowserProxy.open`, the `:vcr_browser_proxy`
+  RSpec tag, and Cuprite helpers (`register_driver`, `driver_options`,
+  `retire_sessions`).

data/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Andrew Fader
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,214 @@
+# vcr-browser-proxy
+
+[![CI](https://github.com/andrewfader/vcr-browser-proxy/actions/workflows/ci.yml/badge.svg)](https://github.com/andrewfader/vcr-browser-proxy/actions/workflows/ci.yml)
+[![Coverage](https://codecov.io/gh/andrewfader/vcr-browser-proxy/branch/main/graph/badge.svg)](https://codecov.io/gh/andrewfader/vcr-browser-proxy)
+[![Gem version](https://img.shields.io/gem/v/vcr-browser-proxy.svg)](https://rubygems.org/gems/vcr-browser-proxy)
+[![Ruby version](https://img.shields.io/gem/required-ruby-version/vcr-browser-proxy.svg)](https://rubygems.org/gems/vcr-browser-proxy)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE.txt)
+
+Record a real browser's HTTPS into the same VCR cassette as your server's own calls.
+
+System specs that drive a real OAuth login, a third-party widget, or a
+presigned S3 download have a gap: VCR only sees requests made from the Ruby
+process, and the browser's requests go straight out. `vcr-browser-proxy` is a
+forward proxy for Chrome that re-issues every browser request through
+[Excon](https://github.com/excon/excon). VCR (`hook_into :excon`) and WebMock's
+Excon adapter then see the browser's traffic exactly as they see the server's:
+record once against the real provider, replay hermetically in CI.
+
+- **No EventMachine.** One Ruby thread per connection, so a slow upstream
+  stalls only its own connection. (puffing-billy generates a keypair per host on
+  its single reactor thread and patches `Kernel#sleep` process-wide.)
+- **One certificate for every host**, generated at boot. Chrome is told to trust
+  exactly that key, through `--ignore-certificate-errors-spki-list`.
+- **An allowlist.** Hosts outside it get an empty `204` and never reach Excon,
+  so Chrome's background telemetry can't pollute a cassette or break a replay.
+- **Redirects are relayed, not followed**, so the browser walks a login flow
+  host by host, through the proxy.
+
+## Installation
+
+```ruby
+# Gemfile
+group :test do
+  gem "vcr-browser-proxy"
+end
+```
+
+Capybara and Cuprite are optional; the Cuprite helpers load them when you call
+them.
+
+## Usage with Capybara and Cuprite
+
+```ruby
+# spec/support/vcr_browser_proxy.rb
+require "vcr_browser_proxy/cuprite"
+require "vcr_browser_proxy/rspec"
+
+VcrBrowserProxy.configure do |config|
+  config.allowed_host_suffixes = %w[okta.com oktacdn.com]
+  # A callable, so each proxy gets fresh rewriters (RedirectOrigin keeps state).
+  config.rewriters = lambda do
+    [
+      VcrBrowserProxy::RedirectOrigin.new(registered_origin: "http://localhost:3000"),
+      VcrBrowserProxy::CrossSiteCookies.new
+    ]
+  end
+  config.on_stop = [VcrBrowserProxy::Cuprite.retire_sessions]
+end
+
+VcrBrowserProxy::Cuprite.register_driver(base_options: { headless: true })
+```
+
+```ruby
+RSpec.describe "Signing in with the identity provider", :vcr, type: :system do
+  it "lands on the dashboard", :vcr_browser_proxy do
+    driven_by :cuprite_vcr_proxy
+
+    visit "/login"
+    click_on "Sign in with Okta"
+    # ...the real Okta pages, recorded into this example's cassette
+  end
+end
+```
+
+The `:vcr_browser_proxy` tag starts a proxy, makes it `VcrBrowserProxy.current`
+for the example and stops it afterwards. Pass options in the tag
+(`vcr_browser_proxy: { allowed_host_suffixes: %w[box.com] }`) to override the
+configured defaults. Without RSpec, `VcrBrowserProxy.open(**options) { |proxy| ... }`
+does the same around a block.
+
+VCR links a new thread's cassette context to the thread that inserted the
+cassette, so the proxy's per-connection threads record into the example's
+cassette with no extra wiring (VCR 6.x).
+
+Chrome skips the proxy for `localhost` and `127.0.0.1`, so the app under test is
+reached directly. `register_driver` drops Cuprite's `url_blacklist`: Ferrum
+implements it by pausing every request with CDP's `Fetch.enable`, and a paused
+navigation that must CONNECT through an upstream proxy never does.
+
+### Retiring browsers
+
+Capybara keeps sessions in a pool, and a browser launched against one proxy
+keeps using that proxy's port after the proxy stops. `Cuprite.retire_sessions`
+is an `on_stop` hook that quits and unpools every session using the proxy's
+driver; `after_quit:` receives each retired session and the sessions still
+pooled, for anything else to tear down. It reaches Capybara's private
+`session_pool`, which is the only handle on pooled sessions.
+
+## Rewriters
+
+A rewriter is any object with `request(exchange)` and/or `response(exchange)`.
+They run in order: `request` before the upstream call, where it may replace
+`exchange.uri`, and `response` after it, where it may edit `status`,
+`response_headers` and `set_cookies`. `exchange.request_origin` gives the page
+that issued the request (Origin, falling back to Referer), and
+`exchange.rewrite_location { |location| ... }` edits redirects.
+
+- `RedirectOrigin` moves redirects aimed at the callback origin you registered
+  with the provider onto the ephemeral port Capybara is actually serving on.
+- `CrossSiteCookies` re-marks relayed cookies `SameSite=None; Secure`, because
+  `http://localhost` is cross-site to every provider. Cookies set inside a
+  third-party iframe are left as the site set them, so a flow that depends on
+  them fails the way it would in a real browser.
+
+A rewriter can also stand in for DNS in a test, sending a made-up host to a
+local server (`spec/e2e` does this for its fake identity provider).
+
+## Diagnostics
+
+`proxy.served` lists every request the proxy answered: host, method, status,
+URL, whether it was ignored, any upstream error, the Authorization scheme
+(`:none`, `:basic`, `:other`), the cookie names sent, and the `Sec-Fetch-*` and
+Referer headers. Pass `logger: ->(line) { warn line }` to see each tunnel and
+relay. Logged URLs omit query strings, which can carry authorization codes. A
+browser closing an idle tunnel without a TLS goodbye is logged as the tunnel
+closing, not as an error.
+
+A request the cassette doesn't hold gets a `502`, and `served` records VCR's
+error, so a replay fails where the gap is.
+
+## Behaviour on the wire
+
+- HTTP/1.1 only; the proxy selects `http/1.1` by ALPN, since a browser that
+  negotiated h2 over the tunnel would send frames it can't read.
+- Request bodies by `Content-Length` or chunked; malformed requests get a `400`.
+- `HEAD` relays the length a `GET` would get; `204` and `304` carry no body.
+- Hop-by-hop headers are dropped in both directions.
+- `GET`, `HEAD` and `OPTIONS` reuse the tunnel's upstream connection and retry
+  (up to `idempotent_retries`) on a timeout or a dropped socket. Anything else
+  goes out once, on a fresh connection, so a stale socket can't swallow a POST.
+
+## Performance
+
+Measured on a busy M4 Pro (load average around 140) against a loopback upstream
+with 2 KB bodies, best of five interleaved rounds; an idle machine will do
+better. `bundle exec rake bench` runs the benchmark-ips version:
+
+| | per request |
+|---|---|
+| Plain proxied request, one per connection | 1.1 ms |
+| Requests over one CONNECT tunnel to a TLS upstream | 0.57 ms |
+
+Requests in a tunnel reuse one upstream connection, so a tunnel of 20 requests
+opens one upstream TLS connection rather than 20.
+
+**WebMock caveat:** while WebMock's Excon adapter is enabled, it opens a new
+connection for every request, including real ones it lets through. Reuse then
+doesn't happen; everything still works.
+
+## Configuration
+
+| Option | Default | |
+|---|---|---|
+| `allowed_host_suffixes` | `[]` | Hosts (and their subdomains) relayed upstream |
+| `rewriters` | `[]` | A list, or a callable returning one |
+| `on_stop` | `[]` | Callables run with the proxy after it stops |
+| `logger` | `nil` | A callable taking a line |
+| `host` | `"127.0.0.1"` | Where the proxy listens (always an ephemeral port) |
+| `read_timeout`, `connect_timeout`, `write_timeout` | `60`, `30`, `60` | Upstream, in seconds |
+| `telemetry_idle_timeout` | `5` | How long a tunnel to a disallowed host may idle |
+| `idempotent_retries` | `3` | Attempts for `GET`/`HEAD`/`OPTIONS` |
+
+## Development
+
+```sh
+bundle install
+bundle exec rake          # RuboCop and the specs
+bundle exec rake e2e      # also the specs that drive real Chrome through the proxy
+bundle exec rake bench    # throughput against a loopback upstream
+```
+
+The specs are in layers: unit specs for each piece, specs of the proxy over
+real sockets against a loopback upstream, integration specs with real VCR and
+WebMock, and end-to-end specs in which headless Chrome signs in to a dummy app
+through a fake identity provider, records the flow, then replays it with the
+provider receiving no requests.
+
+Coverage runs by default and requires at least 95% line coverage and 85% branch
+coverage, including library files that were never loaded. Open
+`coverage/index.html` for the local report; `COVERAGE=false` disables it for
+debugging. CI saves each matrix job's report as an artifact and uploads the
+Ubuntu Ruby 4.0 report to Codecov. Maintainers should enable the repository in
+[Codecov](https://codecov.io/gh/andrewfader/vcr-browser-proxy) and configure the
+`CODECOV_TOKEN` Actions secret for uploads.
+
+## Releasing
+
+Update `lib/vcr_browser_proxy/version.rb` and `CHANGELOG.md`, then run:
+
+```sh
+bundle exec rake
+bundle exec rake e2e  # requires Chrome; set BROWSER_PATH if needed
+bundle exec rake build
+```
+
+Commit the release changes and wait for CI to pass. With RubyGems credentials
+configured using `gem signin`, run `bundle exec rake release` to tag the version,
+push the Git commit and tag, and publish the built gem to RubyGems.org. RubyGems
+may prompt for an MFA code. For a manual upload of an already built release,
+use `gem push pkg/vcr-browser-proxy-VERSION.gem`.
+
+## License
+
+MIT

data/lib/vcr_browser_proxy/configuration.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+class VcrBrowserProxy
+  # Defaults for every proxy, set once in a support file:
+  #
+  #   VcrBrowserProxy.configure do |config|
+  #     config.allowed_host_suffixes = %w[okta.com oktacdn.com]
+  #     config.rewriters = -> { [VcrBrowserProxy::RedirectOrigin.new(registered_origin: "http://localhost:3000")] }
+  #     config.on_stop << ->(proxy) { warn proxy.served.inspect }
+  #   end
+  #
+  # `rewriters` may be a list or a callable returning one. Use a callable when a
+  # rewriter keeps state, so each proxy gets its own.
+  class Configuration
+    OPTIONS = %i[
+      allowed_host_suffixes host read_timeout connect_timeout write_timeout
+      telemetry_idle_timeout idempotent_retries rewriters on_stop logger
+    ].freeze
+
+    attr_accessor(*OPTIONS)
+
+    def initialize
+      @allowed_host_suffixes = []
+      @host = "127.0.0.1"
+      @read_timeout = 60
+      @connect_timeout = 30
+      @write_timeout = 60
+      @telemetry_idle_timeout = 5
+      @idempotent_retries = 3
+      @rewriters = []
+      @on_stop = []
+      @logger = nil
+    end
+
+    def to_options
+      OPTIONS.to_h { |name| [name, public_send(name)] }
+    end
+  end
+end

data/lib/vcr_browser_proxy/cross_site_cookies.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+class VcrBrowserProxy
+  # A test app on http://localhost is cross-site to every provider it signs in
+  # through, so cookies a provider sets as SameSite=Lax would not be sent back on
+  # its own redirects. This re-marks relayed cookies `SameSite=None; Secure`
+  # (valid, since every proxied host is reached over the proxy's TLS tunnel).
+  #
+  # Cookies set in a third-party iframe are left alone, so a flow that depends
+  # on iframe cookies fails here the way it would in a real browser.
+  class CrossSiteCookies
+    def response(exchange)
+      return if third_party_iframe?(exchange)
+
+      exchange.set_cookies = exchange.set_cookies.map { |cookie| self.class.cross_site(cookie) }
+    end
+
+    def self.cross_site(cookie)
+      upgraded = "#{cookie.to_s.sub(/;\s*SameSite=(Lax|Strict|None)/i, "")}; SameSite=None"
+      upgraded.match?(/;\s*Secure/i) ? upgraded : "#{upgraded}; Secure"
+    end
+
+    private
+
+    def third_party_iframe?(exchange)
+      return false unless exchange.request_header("sec-fetch-dest").to_s.casecmp?("iframe")
+
+      origin = exchange.request_origin
+      return false if origin.nil?
+
+      registrable_domain(URI.parse(origin).host) != registrable_domain(exchange.uri.host)
+    rescue URI::InvalidURIError
+      false
+    end
+
+    # Last two labels: enough for the .com/.net hosts this is used against, not a
+    # public-suffix-list lookup.
+    def registrable_domain(hostname)
+      hostname.to_s.downcase.split(".").last(2).join(".")
+    end
+  end
+end

data/lib/vcr_browser_proxy/cuprite.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require "timeout"
+require "vcr_browser_proxy"
+
+class VcrBrowserProxy
+  # Cuprite options that route Chrome through a proxy, and a driver that reads
+  # VcrBrowserProxy.current when Capybara opens its session.
+  module Cuprite
+    DRIVER_NAME = :cuprite_vcr_proxy
+
+    # Background traffic Chrome would otherwise tunnel through the proxy, one
+    # thread per tunnel.
+    QUIET_BACKGROUND_FLAGS = {
+      "disable-background-networking" => nil,
+      "disable-default-apps" => nil,
+      "disable-component-update" => nil,
+      "disable-domain-reliability" => nil,
+      "disable-sync" => nil,
+      "metrics-recording-only" => nil,
+      "no-first-run" => nil
+    }.freeze
+
+    module_function
+
+    # Drops `url_blacklist`/`url_blocklist`: Ferrum implements them with
+    # `Fetch.enable` on every URL, and a paused navigation that has to CONNECT
+    # through an upstream proxy never does.
+    def driver_options(proxy, base: {})
+      options = base.except(:url_blacklist, :url_blocklist)
+      options.merge(
+        proxy: { host: proxy.host, port: proxy.port },
+        browser_options: (base[:browser_options] || {}).merge(browser_flags(proxy))
+      )
+    end
+
+    # `ignore-certificate-errors-spki-list` is honoured only alongside
+    # `--user-data-dir`, which Ferrum always passes.
+    def browser_flags(proxy)
+      {
+        "ignore-certificate-errors" => nil,
+        "ignore-certificate-errors-spki-list" => proxy.certificate_spki_sha256,
+        "proxy-bypass-list" => "127.0.0.1;localhost"
+      }.merge(QUIET_BACKGROUND_FLAGS)
+    end
+
+    # Registers a Capybara driver for VcrBrowserProxy.current. `base_options`
+    # is a hash, or a callable returning one, of your usual Cuprite options;
+    # pass a block to adjust the final options (say, to add Chrome flags).
+    def register_driver(name = DRIVER_NAME, base_options: {}, &customize)
+      require "capybara/cuprite"
+      ::Capybara.register_driver(name) do |app|
+        proxy = VcrBrowserProxy.current
+        raise ArgumentError, "start a VcrBrowserProxy and set VcrBrowserProxy.current before using #{name}" unless proxy
+
+        base = base_options.respond_to?(:call) ? base_options.call : base_options
+        options = driver_options(proxy, base: base)
+        options = yield(options, proxy) if customize
+        ::Capybara::Cuprite::Driver.new(app, **options)
+      end
+    end
+
+    # An on_stop hook. Chrome takes the proxy's port at launch and Capybara
+    # pools sessions across examples, so a browser that outlives its proxy
+    # would send the next example to a dead port. Quits and unpools every
+    # session using `driver_name`, then calls `after_quit` with each session and
+    # the sessions still pooled.
+    def retire_sessions(driver_name = DRIVER_NAME, quit_timeout: 10, after_quit: nil)
+      lambda do |_proxy|
+        pool = ::Capybara.send(:session_pool)
+        retired = pool.select { |_key, session| session.mode == driver_name }
+        retired.each do |key, session|
+          begin
+            Timeout.timeout(quit_timeout) { session.quit }
+          rescue StandardError => e
+            warn "[vcr-proxy] pooled browser quit skipped: #{e.class}: #{e.message}"
+          end
+          pool.delete(key)
+          after_quit&.call(session, pool.values)
+        end
+      end
+    end
+  end
+end

data/lib/vcr_browser_proxy/exchange.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+class VcrBrowserProxy
+  # One browser request and the response relayed for it. Rewriters may replace
+  # `uri` before the upstream call and edit the response fields after it.
+  class Exchange
+    attr_accessor :request_method, :uri, :request_headers, :request_body,
+                  :status, :response_headers, :set_cookies
+
+    def initialize(request_method:, uri:, request_headers:, request_body: nil)
+      @request_method = request_method
+      @uri = uri
+      @request_headers = request_headers
+      @request_body = request_body
+      @response_headers = {}
+      @set_cookies = []
+    end
+
+    def request_header(name)
+      header(request_headers, name)
+    end
+
+    def response_header(name)
+      Array(header(response_headers, name)).first
+    end
+
+    # Applies the block to every Location value and keeps the header's shape.
+    def rewrite_location
+      response_headers.each_key do |key|
+        next unless key.to_s.casecmp?("location")
+
+        values = Array(response_headers[key]).map { |location| yield location.to_s }
+        response_headers[key] = values.one? ? values.first : values
+      end
+    end
+
+    # :none, :basic or :other, from the browser's Authorization header.
+    def auth_scheme
+      value = request_header("authorization").to_s
+      return :none if value.empty?
+      return :basic if value.downcase.start_with?("basic ")
+
+      :other
+    end
+
+    def request_cookie_names
+      request_header("cookie").to_s.split(";").filter_map do |pair|
+        name = pair.split("=", 2).first.to_s.strip
+        name unless name.empty?
+      end
+    end
+
+    # The page that issued the request, from Origin, falling back to Referer:
+    # headless Chrome sends some CORS GETs with a Referer and no Origin.
+    def request_origin
+      origin = request_header("origin").to_s
+      return origin unless origin.empty? || origin == "null"
+
+      referer = URI.parse(request_header("referer").to_s)
+      return nil unless %w[http https].include?(referer.scheme) && referer.host
+
+      port = referer.port == referer.default_port ? "" : ":#{referer.port}"
+      "#{referer.scheme}://#{referer.host}#{port}"
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    private
+
+    def header(headers, name)
+      headers.find { |key, _| key.to_s.casecmp?(name) }&.last
+    end
+  end
+end

data/lib/vcr_browser_proxy/http_reader.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+class VcrBrowserProxy
+  # Reads HTTP/1.1 requests off a socket through its own buffer, so a request
+  # the browser sent right behind another is never stranded in a buffer that a
+  # readability check on the socket can't see.
+  class HttpReader
+    Request = Struct.new(:request_method, :target, :headers, :body)
+
+    CHUNK = 16 * 1024
+    MAX_LINE = 64 * 1024
+
+    class MalformedRequest < StandardError; end
+
+    def initialize(io)
+      @io = io
+      @buffer = +""
+      @eof = false
+    end
+
+    def buffered?
+      !@buffer.empty? || (@io.respond_to?(:pending) && @io.pending.positive?)
+    end
+
+    def readable?(timeout)
+      buffered? || !@io.to_io.wait_readable(timeout).nil?
+    end
+
+    # nil when the peer closed before sending a request line.
+    def request
+      line = read_line
+      return nil if line.nil?
+
+      method, target, = line.split(" ", 3)
+      raise MalformedRequest, "bad request line" if method.nil? || target.nil?
+
+      headers = read_headers
+      Request.new(method.upcase, target, headers, read_body(headers))
+    end
+
+    private
+
+    def read_headers
+      headers = {}
+      while (line = read_line)
+        break if line.empty?
+
+        key, value = line.split(":", 2)
+        next unless value
+
+        add_header(headers, key.strip, value.strip)
+      end
+      headers
+    end
+
+    # Repeated fields join with a comma (RFC 9110 5.3), Cookie with "; ".
+    def add_header(headers, key, value)
+      existing = headers.keys.find { |name| name.casecmp?(key) }
+      if existing
+        separator = key.casecmp?("cookie") ? "; " : ", "
+        headers[existing] = "#{headers[existing]}#{separator}#{value}"
+      else
+        headers[key] = value
+      end
+    end
+
+    def read_body(headers)
+      if header(headers, "transfer-encoding").to_s.downcase.include?("chunked")
+        read_chunked
+      else
+        length = header(headers, "content-length").to_i
+        length.positive? ? read_exactly(length) : nil
+      end
+    end
+
+    def read_chunked
+      body = +""
+      while (size = chunk_size(read_line)).positive?
+        body << read_exactly(size)
+        read_line
+      end
+      skip_trailers
+      body
+    end
+
+    def chunk_size(line)
+      raise MalformedRequest, "truncated chunked body" if line.nil?
+
+      Integer(line.split(";", 2).first.strip, 16)
+    rescue ArgumentError
+      raise MalformedRequest, "bad chunk size"
+    end
+
+    def skip_trailers
+      line = read_line
+      line = read_line while line && !line.empty?
+    end
+
+    def header(headers, name)
+      headers.find { |key, _| key.casecmp?(name) }&.last
+    end
+
+    def read_line
+      index = @buffer.index("\n")
+      while index.nil?
+        raise MalformedRequest, "line too long" if @buffer.bytesize > MAX_LINE
+        return take_rest unless fill
+
+        index = @buffer.index("\n")
+      end
+      @buffer.slice!(0..index).chomp
+    end
+
+    def take_rest
+      @buffer.empty? ? nil : @buffer.slice!(0..).chomp
+    end
+
+    def read_exactly(length)
+      fill while @buffer.bytesize < length && !@eof
+      raise MalformedRequest, "body shorter than its length" if @buffer.bytesize < length
+
+      @buffer.slice!(0, length)
+    end
+
+    def fill
+      return false if @eof
+
+      @buffer << @io.readpartial(CHUNK)
+      true
+    rescue EOFError
+      @eof = true
+      false
+    end
+  end
+end

data/lib/vcr_browser_proxy/redirect_origin.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+class VcrBrowserProxy
+  # OAuth providers redirect to the one callback origin registered with them
+  # (say http://localhost:3000), while Capybara serves the app on an ephemeral
+  # port. This rewrites redirects to the registered origin onto the port the
+  # browser is actually using, read from the requests' Origin/Referer.
+  class RedirectOrigin
+    def initialize(registered_origin:)
+      @registered_origin = registered_origin.to_s.chomp("/")
+      @active_origin = nil
+      @mutex = Mutex.new
+    end
+
+    def request(exchange)
+      origin = local_origin(exchange.request_origin)
+      @mutex.synchronize { @active_origin = origin } if origin
+    end
+
+    def response(exchange)
+      active = @mutex.synchronize { @active_origin }
+      return if active.nil? || active == @registered_origin
+
+      exchange.rewrite_location do |location|
+        location.start_with?(@registered_origin) ? location.sub(@registered_origin, active) : location
+      end
+    end
+
+    private
+
+    def local_origin(origin)
+      return nil if origin.nil?
+
+      uri = URI.parse(origin)
+      "#{uri.scheme}://#{uri.host}:#{uri.port}" if uri.scheme == "http" && %w[localhost 127.0.0.1].include?(uri.host)
+    rescue URI::InvalidURIError
+      nil
+    end
+  end
+end

data/lib/vcr_browser_proxy/rspec.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "vcr_browser_proxy"
+
+# Tag an example `vcr_browser_proxy: true` (or a hash of proxy options) to run
+# it with a started proxy as VcrBrowserProxy.current, stopped afterwards:
+#
+#   it "signs in", :vcr, vcr_browser_proxy: { allowed_host_suffixes: %w[okta.com] } do
+#     driven_by :cuprite_vcr_proxy
+#     ...
+#   end
+#
+# The example can read the proxy as `vcr_browser_proxy`.
+class VcrBrowserProxy
+  module RSpec
+    def vcr_browser_proxy
+      VcrBrowserProxy.current
+    end
+  end
+end
+
+RSpec.configure do |config|
+  config.include VcrBrowserProxy::RSpec, :vcr_browser_proxy
+  config.around(:each, :vcr_browser_proxy) do |example|
+    options = example.metadata[:vcr_browser_proxy]
+    options = {} unless options.is_a?(Hash)
+    VcrBrowserProxy.open(**options) { example.run }
+  end
+end

data/lib/vcr_browser_proxy/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class VcrBrowserProxy
+  VERSION = "0.1.0"
+end

data/lib/vcr_browser_proxy.rb

@@ -0,0 +1,478 @@
+# frozen_string_literal: true
+
+require "socket"
+require "openssl"
+require "uri"
+require "excon"
+require "rack/utils"
+
+require_relative "vcr_browser_proxy/version"
+require_relative "vcr_browser_proxy/configuration"
+require_relative "vcr_browser_proxy/exchange"
+require_relative "vcr_browser_proxy/http_reader"
+require_relative "vcr_browser_proxy/redirect_origin"
+require_relative "vcr_browser_proxy/cross_site_cookies"
+
+# A plain-threaded MITM forward proxy for browser-driven tests. Each browser
+# request is re-issued through Excon, so a VCR cassette hooked into Excon (and
+# WebMock's Excon adapter) sees the browser's HTTPS exactly as it sees the
+# server's own calls: one cassette records and replays both.
+#
+# One self-signed certificate serves every tunnel, so no keypair is generated
+# per host, and each connection gets its own thread, so a slow upstream stalls
+# only its own connection.
+class VcrBrowserProxy
+  # RFC 9110 7.6.1: never forwarded between the browser leg and the upstream leg.
+  HOP_BY_HOP = %w[
+    connection keep-alive proxy-authenticate proxy-authorization
+    te trailer transfer-encoding upgrade proxy-connection
+  ].freeze
+
+  IDEMPOTENT_METHODS = %w[GET HEAD OPTIONS].freeze
+
+  # A browser dropping an idle tunnel without a TLS close_notify. OpenSSL 3
+  # raises where OpenSSL 1 returned EOF; between requests it is routine teardown.
+  TEARDOWN_ERRORS = [EOFError, Errno::ECONNRESET, Errno::EPIPE, OpenSSL::SSL::SSLError, IOError].freeze
+
+  class << self
+    # The proxy a driver factory reads to learn the port to point the browser at.
+    attr_accessor :current
+
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    # Defaults every proxy starts from; keyword arguments to .new override them.
+    def configure
+      yield configuration
+    end
+
+    def reset_configuration!
+      @configuration = Configuration.new
+    end
+  end
+
+  attr_reader :host, :port, :allowed_host_suffixes
+
+  # allowed_host_suffixes - hosts that are re-issued upstream. Anything else
+  #   (browser telemetry, update pings) gets an empty 204 and never reaches Excon.
+  # rewriters - objects responding to `request(exchange)` and/or
+  #   `response(exchange)`, run in order around the upstream call. Defaults to
+  #   the configured rewriter factory, called once per proxy so stateful
+  #   rewriters start fresh.
+  # on_stop - callables run with the proxy after it stops.
+  # telemetry_idle_timeout - how long a tunnel to a disallowed host may sit idle.
+  #   Kept short so speculative tunnels don't each park a thread.
+  def initialize(**options)
+    settings = self.class.configuration.to_options.merge(options)
+    unknown = settings.keys - Configuration::OPTIONS
+    raise ArgumentError, "unknown option(s): #{unknown.join(", ")}" if unknown.any?
+
+    @allowed_host_suffixes = Array(settings[:allowed_host_suffixes]).map { |suffix| suffix.to_s.downcase }.freeze
+    @host = settings[:host]
+    @read_timeout = settings[:read_timeout]
+    @connect_timeout = settings[:connect_timeout]
+    @write_timeout = settings[:write_timeout]
+    @telemetry_idle_timeout = settings[:telemetry_idle_timeout]
+    @idempotent_retries = settings[:idempotent_retries]
+    @rewriters = Array(settings[:rewriters].respond_to?(:call) ? settings[:rewriters].call : settings[:rewriters])
+    @on_stop = Array(settings[:on_stop])
+    @logger = settings[:logger]
+    @server = TCPServer.new(@host, 0)
+    @port = @server.addr[1]
+    @threads = []
+    @threads_mutex = Mutex.new
+    @served = []
+    @served_mutex = Mutex.new
+    @running = false
+    @ssl_context = build_ssl_context
+  end
+
+  def start
+    return self if @running
+
+    @running = true
+    server = @server
+    @acceptor = Thread.new do
+      Thread.current.name = "vcr-proxy-acceptor"
+      accept_loop(server)
+    end
+    self
+  end
+
+  def stop
+    return self unless @server
+
+    @running = false
+    server = @server
+    @server = nil
+    server.close
+    @acceptor&.kill
+    @threads_mutex.synchronize do
+      @threads.each(&:kill)
+      @threads.clear
+    end
+    @on_stop.each { |hook| hook.call(self) }
+    self
+  end
+
+  def running?
+    @running
+  end
+
+  # Starts the proxy, makes it .current for the block, and always stops it.
+  def self.open(**)
+    proxy = new(**).start
+    previous = current
+    self.current = proxy
+    yield proxy
+  ensure
+    self.current = previous
+    proxy&.stop
+  end
+
+  # One hash per request the proxy answered, for assertions and diagnostics.
+  def served
+    @served_mutex.synchronize { @served.dup }
+  end
+
+  # Base64 SHA-256 of the certificate's SubjectPublicKeyInfo: the form Chrome's
+  # `--ignore-certificate-errors-spki-list` matches. With the key allowlisted,
+  # Chrome skips certificate verification for the tunnel altogether.
+  def certificate_spki_sha256
+    [OpenSSL::Digest::SHA256.digest(@ssl_context.cert.public_key.public_to_der)].pack("m0")
+  end
+
+  def host_allowed?(hostname)
+    return false if hostname.nil?
+
+    hostname = hostname.downcase
+    @allowed_host_suffixes.any? { |suffix| hostname == suffix || hostname.end_with?(".#{suffix}") }
+  end
+
+  private
+
+  def accept_loop(server)
+    while @running
+      begin
+        client = server.accept
+      rescue IOError, Errno::EBADF
+        break
+      rescue SystemCallError
+        next
+      end
+
+      thread = Thread.new(client) do |socket|
+        Thread.current.name = "vcr-proxy-conn"
+        handle_connection(socket)
+      end
+      @threads_mutex.synchronize do
+        @threads.select!(&:alive?)
+        @threads << thread
+      end
+    end
+  end
+
+  def handle_connection(socket)
+    reader = HttpReader.new(socket)
+    request = reader.request
+    return unless request
+
+    if request.request_method == "CONNECT"
+      handle_connect(socket, request.target)
+    else
+      Upstreams.with { |upstreams| serve(socket, request, URI.parse(request.target), upstreams, keep_alive: false) }
+    end
+  rescue HttpReader::MalformedRequest, URI::InvalidURIError => e
+    reject_malformed(socket, e)
+  rescue *TEARDOWN_ERRORS => e
+    log "connection closed: #{e.class}"
+  rescue StandardError => e
+    log "connection error: #{e.class}: #{e.message}"
+  ensure
+    socket.close unless socket.closed?
+  end
+
+  def reject_malformed(io, error)
+    log "malformed request: #{error.message}"
+    write_response(io, Reply.new(400, { "Content-Type" => "text/plain" }, [], "vcr-browser-proxy: #{error.message}"),
+                   keep_alive: false)
+  rescue *TEARDOWN_ERRORS
+    nil
+  end
+
+  # Answer CONNECT, present the static certificate, then serve every request the
+  # browser pipelines through the tunnel until it goes idle or closes. Upstream
+  # connections opened for the tunnel are reused for its later requests.
+  def handle_connect(socket, target)
+    connect_host, connect_port = target.split(":", 2)
+    allowed = host_allowed?(connect_host)
+    log "CONNECT #{target} (allowed=#{allowed})"
+    socket.write("HTTP/1.1 200 Connection established\r\n\r\n")
+    socket.flush
+
+    ssl = OpenSSL::SSL::SSLSocket.new(socket, @ssl_context)
+    ssl.sync_close = true
+    begin
+      ssl.accept
+    rescue OpenSSL::SSL::SSLError, *TEARDOWN_ERRORS => e
+      log "TLS accept failed for #{connect_host}: #{e.message}"
+      return
+    end
+
+    authority = connect_port.nil? || connect_port == "443" ? connect_host : target
+    serve_tunnel(ssl, connect_host, authority, allowed ? @read_timeout : @telemetry_idle_timeout)
+  ensure
+    ssl&.close unless ssl.nil? || ssl.closed?
+  end
+
+  def serve_tunnel(ssl, connect_host, authority, idle_timeout)
+    reader = HttpReader.new(ssl)
+    requests = 0
+    Upstreams.with do |upstreams|
+      loop do
+        unless reader.readable?(idle_timeout)
+          log "tunnel idle timeout for #{connect_host} after #{requests} request(s)"
+          break
+        end
+
+        request = begin
+          reader.request
+        rescue HttpReader::MalformedRequest => e
+          reject_malformed(ssl, e)
+          break
+        rescue *TEARDOWN_ERRORS
+          nil
+        end
+        unless request
+          log "tunnel closed for #{connect_host} after #{requests} request(s)"
+          break
+        end
+
+        requests += 1
+        break unless serve(ssl, request, URI.parse("https://#{authority}#{request.target}"), upstreams,
+                           keep_alive: true)
+      end
+    end
+  end
+
+  # Returns whether the connection stays open for the next request.
+  def serve(io, request, uri, upstreams, keep_alive:)
+    exchange = Exchange.new(request_method: request.request_method, uri: uri, request_headers: request.headers,
+                            request_body: request.body)
+
+    if host_allowed?(uri.host)
+      write_response(io, relay(exchange, upstreams), head_only: exchange.request_method == "HEAD",
+                                                     keep_alive: keep_alive)
+    else
+      # Keep the tunnel so the browser reuses one handshake for its repeated
+      # pings; the short idle timeout bounds the thread.
+      record_served(exchange, 204, ignored: true)
+      write_response(io, Reply.new(204, {}, [], ""), keep_alive: keep_alive)
+    end
+    keep_alive
+  rescue *TEARDOWN_ERRORS => e
+    # The browser went away mid-response; there is no one left to answer.
+    log "browser closed during #{log_url(uri)}: #{e.class}"
+    false
+  rescue StandardError => e
+    log "upstream error for #{log_url(uri)}: #{e.class}: #{e.message}"
+    record_served(exchange, 502, ignored: false, error: "#{e.class}: #{e.message}") if exchange
+    write_response(io, Reply.new(502, { "Content-Type" => "text/plain" }, [], "vcr-browser-proxy upstream error"),
+                   keep_alive: false)
+    false
+  end
+
+  # Runs the rewriters around the upstream call and returns what to send back.
+  def relay(exchange, upstreams)
+    @rewriters.each { |rewriter| rewriter.request(exchange) if rewriter.respond_to?(:request) }
+    response = perform_upstream(exchange, upstreams)
+    exchange.status = response.status
+    exchange.set_cookies = extract_set_cookies(response)
+    exchange.response_headers = response.headers.to_h.reject do |key, _|
+      HOP_BY_HOP.include?(key.to_s.downcase) || key.to_s.casecmp?("set-cookie")
+    end
+    @rewriters.each { |rewriter| rewriter.response(exchange) if rewriter.respond_to?(:response) }
+
+    record_served(exchange, exchange.status, ignored: false)
+    location = exchange.response_header("location")
+    log "relayed #{exchange.status} #{exchange.request_method} #{log_url(exchange.uri)}" \
+        "#{" -> #{log_url(location)}" if location}"
+    Reply.new(exchange.status, exchange.response_headers, exchange.set_cookies, response.body.to_s)
+  end
+
+  # Idempotent requests reuse the tunnel's upstream connection and retry on a
+  # timeout or a dropped socket (a reused connection the server already closed).
+  # Anything else goes out once, on a fresh connection.
+  def perform_upstream(exchange, upstreams)
+    forwarded = exchange.request_headers.reject do |key, _|
+      HOP_BY_HOP.include?(key.to_s.downcase) || key.to_s.casecmp?("host")
+    end
+    idempotent = IDEMPOTENT_METHODS.include?(exchange.request_method)
+    attempts = idempotent ? @idempotent_retries : 1
+    attempt = 0
+
+    begin
+      attempt += 1
+      connection = if idempotent
+                     upstreams.for(exchange.uri) { |origin| new_connection(origin, persistent: true) }
+                   else
+                     new_connection(Upstreams.origin(exchange.uri), persistent: false)
+                   end
+      path = exchange.uri.path.empty? ? "/" : exchange.uri.path
+      connection.request(method: exchange.request_method.to_sym, path: path, query: exchange.uri.query,
+                         headers: forwarded, body: exchange.request_body)
+    rescue Excon::Error::Timeout, Excon::Error::Socket => e
+      upstreams.discard(exchange.uri)
+      raise if attempt >= attempts
+
+      log "retrying #{exchange.request_method} #{log_url(exchange.uri)} after #{e.class} " \
+          "(attempt #{attempt + 1}/#{attempts})"
+      sleep(0.5 * attempt) if e.is_a?(Excon::Error::Timeout)
+      retry
+    end
+  end
+
+  def new_connection(origin, persistent:)
+    Excon.new(
+      origin,
+      persistent: persistent,
+      read_timeout: @read_timeout,
+      connect_timeout: @connect_timeout,
+      write_timeout: @write_timeout,
+      # The browser follows redirects itself, through this proxy.
+      middlewares: Excon.defaults[:middlewares] - [Excon::Middleware::RedirectFollower]
+    )
+  end
+
+  # A live response carries each Set-Cookie separately in `data[:cookies]`; a
+  # response VCR rebuilt from a cassette has only the (possibly joined) header.
+  def extract_set_cookies(response)
+    cookies = response.data[:cookies] if response.respond_to?(:data)
+    return Array(cookies) if cookies && !cookies.empty?
+
+    raw = response.headers["Set-Cookie"] || response.headers["set-cookie"]
+    raw ? Array(raw) : []
+  end
+
+  Reply = Struct.new(:status, :headers, :set_cookies, :body) do
+    def bodiless?
+      [204, 304].include?(status.to_i)
+    end
+
+    def header(name)
+      Array(headers.find { |key, _| key.to_s.casecmp?(name) }&.last).first
+    end
+  end
+  # The proxy frames the browser leg itself.
+  FRAMING_HEADERS = %w[content-length transfer-encoding connection].freeze
+  private_constant :Reply, :FRAMING_HEADERS
+
+  # head_only: answering a HEAD, whose length describes the body a GET would get.
+  def write_response(io, reply, keep_alive:, head_only: false)
+    head = "HTTP/1.1 #{reply.status} #{Rack::Utils::HTTP_STATUS_CODES.fetch(reply.status.to_i, "Unknown")}\r\n"
+    reply.headers.each do |key, value|
+      next if FRAMING_HEADERS.include?(key.to_s.downcase)
+
+      Array(value).each { |line| head << "#{key}: #{line}\r\n" }
+    end
+    reply.set_cookies.each { |cookie| head << "Set-Cookie: #{cookie}\r\n" }
+    head << "Content-Length: #{content_length(reply, head_only)}\r\n" unless reply.bodiless?
+    head << "Connection: #{keep_alive ? "keep-alive" : "close"}\r\n\r\n"
+    io.write(head)
+    io.write(reply.body) unless head_only || reply.bodiless?
+    io.flush
+  end
+
+  def content_length(reply, head_only)
+    (head_only && reply.header("content-length")) || reply.body.bytesize
+  end
+
+  def record_served(exchange, status, ignored:, error: nil)
+    entry = {
+      host: exchange.uri.host,
+      method: exchange.request_method,
+      status: status,
+      url: exchange.uri.to_s,
+      ignored: ignored,
+      error: error,
+      auth: exchange.auth_scheme,
+      cookie_names: exchange.request_cookie_names,
+      sec_fetch_dest: exchange.request_header("sec-fetch-dest").to_s,
+      sec_fetch_site: exchange.request_header("sec-fetch-site").to_s,
+      referer: exchange.request_header("referer").to_s
+    }
+    @served_mutex.synchronize { @served << entry }
+  end
+
+  # One certificate for every tunnel keeps RSA keygen off the request path.
+  def build_ssl_context
+    key = OpenSSL::PKey::RSA.new(2048)
+    cert = OpenSSL::X509::Certificate.new
+    cert.version = 2
+    cert.serial = 1
+    name = OpenSSL::X509::Name.parse("/CN=vcr-browser-proxy")
+    cert.subject = name
+    cert.issuer = name
+    cert.public_key = key.public_key
+    # A wide window, so a frozen test clock never lands outside it.
+    cert.not_before = Time.at(0).utc
+    cert.not_after = Time.at(0).utc + (100 * 365 * 24 * 60 * 60)
+    cert.sign(key, OpenSSL::Digest.new("SHA256"))
+
+    context = OpenSSL::SSL::SSLContext.new
+    context.cert = cert
+    context.key = key
+    # The reader speaks HTTP/1.1 only; a browser that negotiated h2 over the
+    # tunnel would send frames no request line can be read from.
+    context.alpn_select_cb = ->(_protocols) { "http/1.1" }
+    context
+  end
+
+  # Query strings can carry codes and tokens, so logs show the path only.
+  def log_url(url)
+    uri = url.is_a?(URI) ? url : URI.parse(url.to_s)
+    "#{uri.scheme}://#{uri.host}#{uri.path}"
+  rescue URI::InvalidURIError
+    "(unparseable URL)"
+  end
+
+  def log(message)
+    @logger&.call("[vcr-proxy] #{message}")
+  end
+
+  # Upstream Excon connections for one browser connection, keyed by origin.
+  # Excon connections are not thread-safe, and a browser connection is served
+  # by one thread, so the pool lives exactly as long as that thread's loop.
+  class Upstreams
+    def self.with
+      upstreams = new
+      yield upstreams
+    ensure
+      upstreams&.close
+    end
+
+    def initialize
+      @connections = {}
+    end
+
+    def self.origin(uri)
+      "#{uri.scheme}://#{uri.host}:#{uri.port}"
+    end
+
+    def for(uri)
+      origin = self.class.origin(uri)
+      @connections[origin] ||= yield(origin)
+    end
+
+    def discard(uri)
+      @connections.delete(self.class.origin(uri))&.reset
+    end
+
+    def close
+      @connections.each_value(&:reset)
+      @connections.clear
+    end
+  end
+  private_constant :Upstreams
+end

metadata

@@ -0,0 +1,90 @@
+--- !ruby/object:Gem::Specification
+name: vcr-browser-proxy
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Andrew Fader
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: excon
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.100'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.100'
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+description: |
+  A threaded MITM forward proxy for Capybara/Cuprite system tests. It re-issues
+  each browser request through Excon, so VCR and WebMock see browser traffic
+  (an OAuth login, a third-party widget, a presigned S3 fetch) the same way
+  they see server traffic. No EventMachine, one certificate for every host.
+email:
+- fader@yagni.co
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- lib/vcr_browser_proxy.rb
+- lib/vcr_browser_proxy/configuration.rb
+- lib/vcr_browser_proxy/cross_site_cookies.rb
+- lib/vcr_browser_proxy/cuprite.rb
+- lib/vcr_browser_proxy/exchange.rb
+- lib/vcr_browser_proxy/http_reader.rb
+- lib/vcr_browser_proxy/redirect_origin.rb
+- lib/vcr_browser_proxy/rspec.rb
+- lib/vcr_browser_proxy/version.rb
+homepage: https://github.com/andrewfader/vcr-browser-proxy
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/andrewfader/vcr-browser-proxy
+  source_code_uri: https://github.com/andrewfader/vcr-browser-proxy
+  changelog_uri: https://github.com/andrewfader/vcr-browser-proxy/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/andrewfader/vcr-browser-proxy/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.20
+specification_version: 4
+summary: Record a real browser's HTTPS into the same VCR cassette as your server's
+  calls
+test_files: []