History

History

The History tab is the searchable, filterable log of every request and response that passes through the proxy. It is the first place to look when you want to see what an application is doing or go back and inspect a specific request.

Request list

Each captured request shows its method, host, path, status code, response size, and time. New requests stream in as they are captured. The list is sorted newest-first by default; click a column to change the sort, and your choice persists across reloads.

Filters

The filter controls above the list narrow the results:

• Host: substring match on the host.
• URL: substring match on the URL.
• Method: a multi-select. Pick any number of methods and they are OR'd together.
• Status: toggle chips for 1xx through 5xx, plus none for requests where no response was captured. Alongside them, a box accepts exact codes and inclusive ranges — 403,500-599. Chips and codes are OR'd. A half-typed entry is ignored rather than blanking the table.
• Extension: include or exclude by file extension.
• Content: match a string or regular expression against the raw request and response bytes, case-insensitively. Choose Include to keep only matches or Exclude to hide them.

The Content filter is where you go for "show me every response that mentions Set-Cookie" or "hide everything containing this session token". Because it runs server-side, live-streamed rows bypass it until you reload or refetch — the other filters apply to streaming rows immediately.

The content and extension filters persist across reloads. Method and status deliberately do not: a status filter silently restored from a previous session looks exactly like the proxy having stopped capturing.

Highlights

Right-click a row and pick Highlight to tint it, or Clear Highlight to remove one. The nine colours are Red, Orange, Yellow, Green, Cyan, Blue, Purple, Pink and Gray, and they mean whatever you decide — Joro attaches no semantics to them.

A highlight is a marker, not a record. It survives in the engagement rather than in the browser: highlights are saved into the project file, published with a shared project, and cleared when you start a new empty project. See Projects. When a conclusion needs to outlive the colour, write it up in Notes or record it in Detect.

An automation client granted history_highlight can set and clear these too, which is a convenient way to have an agent mark rows worth a second look while you read your own History. An agent's highlight appears on your next History load rather than live, so a colour you did not set may show up after a reload.

The same right-click menu carries Run automation when you have an installed automation that declares the request.selected trigger. Picking one runs it against that request and opens the result over the page — see Scripting.

Request and response detail

Click any row to open the full request and response with syntax highlighting. Headers and body are shown separately. Large bodies are rendered with the appropriate formatter (JSON, HTML, XML, form data).

Right-click a row or the detail pane for the actions available on that request, including sending it to Manipulate or Fuzz, copying it as curl, Flag to team when you are on a Team-Server, and Stage for Dead Drop (see Dead-Drop).

Oblivious HTTP

Firefox routes some traffic through Oblivious HTTP relays. Those relays are in the default noise filter list, so they are tunneled silently and never clutter the list. If you do capture OHTTP traffic, the Render tab shows a summary of the cleartext envelope plus a hex dump rather than mojibake, and the Raw tab stays byte-exact.

OHTTP bodies cannot be edited. The ciphertext is authenticated to a gateway key Joro does not hold, so any modification would simply be rejected downstream.

WebSocket sub-tab

Within the History tab there is a WebSocket sub-tab that shows captured WebSocket frames alongside normal HTTP traffic. Each message lists its direction (client-to-server or server-to-client), opcode, payload size, the host and URL of the parent connection, and a preview of the payload. Control frames are forwarded immediately; text and binary data frames are fully accumulated before display. The maximum payload size supported is 16 MB.

Clearing history

A clear button empties the in-memory history, after a confirmation. This does not affect any rules, scope, or other settings, and by default it leaves Detect findings in place.

Where requests come from

What lands here is governed by the scope and noise filter controls on Settings. Out-of-scope hosts and noisy background traffic (captive portal, telemetry, OCSP) never appear in the list.

Deleting a host or endpoint from Map also removes the underlying requests from here.

Related

• Detect passively scans everything captured here.
• Intercept to pause requests and responses before they leave the proxy.
• Manipulate to replay any captured request with modifications.
• Dead-Drop to package requests into a file for another operator.
• Scripting to run an automation over a request you picked, or add a lens tab beside Raw and Render.
• Automation for the capability an agent needs to highlight a row, and where its own sends land.