Lazy Diary @ Hatena Blog

PowerShell / Java / miscellaneous things about software development, Tips & Gochas. CC BY-SA 4.0/Apache License 2.0

Pause before HTTP redirect (302) and get redirection URI with Chrome developer tools


  • When you try to attack to OAuth2 Authorization Code Flow with CSRF (See RFC 6749 "10.12. Cross-Site Request Forgery"), you have to pause before redirect in order to get redirection URI, because the redirection URI is unique and will be invalidated after the access to the URI.
  • Client local proxy like Burp Suite or Fiddler is widly used for this purpose. But sometimes it is prohibited to install such local proxy, because of asset management policy or security policy of their organization.
  • With Chrome, you can pause before redirect with code below (See Chrome: pause before redirect). This code can just pause before redirect, but you cannot get redirection URI (No request will be shown in the Network tab on Chrome developer tools).
window.addEventListener("beforeunload", function() { debugger; }, false)


  1. Open Chrome developer tools and open "Network" tab.
  2. Once access to an URL that redirect request.
  3. Right-click the redirection URI and select "Block request URL". The "Request blocking" tab will be automatically opened.
  4. In the "Request blocking" tab, replace variable part of URI with wildcard (*).
  5. Access to the URL same as 2. again.
  6. In the "Network" tab, the blocked request (request URI) will be hilighted in red. Right-click the request and select [Copy]-[Copy link address].

Push source to GitHub/GitLab repository without type password


The passphrase stored in ssh-agent is invalidated when the git client machine is rebooted.

If you want to access GitHub/GitLab without type password (e.g. push/pull source in Jenkins), you have to use a ssh public/public key pair without passphrase, rather than ssh-agent.


1. Make a key pair for GitHub/GitLab

Make a new key pair with ssh-keygen. You can use ssh-keygen -t ecdsa, or ssh-keygen -t ed25519 for more security. In GitLab, ssh-keygen -t ed25519 is acceptable on GitLab 10.3 or later.

$ ssh-keygen -t rsa

For convenience, make a new public/public key pair (~/.ssh/id_rsa_nopassphrase) without passphrase.

Generating public/private rsa key pair.
Enter file in which to save the key (/home/yourname/.ssh/id_rsa): /home/yourname/.ssh/id_rsa_nopassphrase

For passphrase prompt, just type enter twice (no passphrase).

Enter passphrase (empty for no passphrase): 
Enter same passphrase again:

ssh-keygen will make a new key pair.

Your identification has been saved in /home/yourname/.ssh/id_rsa_nopassphrase.
Your public key has been saved in /home/yourname/.ssh/
The key fingerprint is:

The key's randomart image is:
+---[RSA 2048]----+
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |

2. Set the new public key to GitHub/GitLab

Open the new public key (~/.ssh/ and copy&paste the content.

  • If you use GitLab, Open 'SSH Keys' tab in 'Profile Settings', and paste the key in the 'Key' section.
  • If you use GitHub, Open 'SSH and GPG keys' tab in 'Settings', push 'New SSH key', and paste the key in the 'Key' section.

3. Make git to use the new private key

Make ~/.ssh/config file if it isn't exist. add the content below to the ~/.ssh/config. This setting makes git to use the new private key for ssh connection.

    User git
    IdentityFile ~/.ssh/id_rsa_nopassphrase
    Port 22

4. Test the connection to GitHub/GitLab

$ ssh -T
Hi yourname! You've successfully authenticated, but GitHub does not provide shell access.

If any error occurred, try ssh -Tv, and see the messages.

5. Try git command

Note that use the username git (not your account name in GitHub/GitLab) in comnand.

$ git clone --depth 1
$ cd repository/
$ git push
Everything up-to-date

How to escape special characters in PowerShell

Ways to escape special characters in PowerShell are different between its context, and so complecated...

# Context Escaped char " ' \ ` ``
1 String with " "
2 String with " $
3 String with " '
4 String with " `
5 String with ' "
6 String with ' $
7 String with ' '
8 String with ' `
9 Operand of -like with " *
10 Operand of -like with ' *
11 Operand of -match with " *
12 Operand of -match with ' *
13 Placeholder of -F operator *1 { and }


  • ✓ … You can use it to escape
  • ✘ … You cannot use it to escape
  • - … You don't have to escape

Invoke-RestMethod to GitLab API causes mojibake


In PowerShell, You can call REST API with Invoke-RestMethod like:

Invoke-RestMethod -Headers $headers -Method Get -Timeout 10 -Uri ""


The result of Invoke-RestMethod causes mojibake when the response contains non-ASCII characters like Japanese/Chinese characters.


  • Invoke-RestMethod treats the charset of the HTTP response as ISO-8859-1 rather than UTF-8, when the response doesn't have Content-Type: ... charset=utf-8 in HTTP header.
  • The response of GitLab API doesn't have Content-Type HTTP header.


Use Invoke-WebRequest rather than Invoke-RestMethod. You can decode the content of HTTP response as UTF-8 explicitly.

$res = (Invoke-WebRequest -Headers $headers -Method Get -Timeout 10-Uri "")
$con = [System.Text.Encoding]::Utf8.GetString([System.Text.Encoding]::GetEncoding("ISO-8859-1").GetBytes($res.Content))
ConvertFrom-Json $con

Format operator with string contains "{" and "}"


In PowerShell, you can format a string with -F operator like:

  Get-Content foo.csv | ConvertFrom-Csv -Header Name,Code,Address | `
  ForEach-Object {
    "{0} `n {1} {2}" -F $_.Name,$_.Code,$_.Address


-F operator returns error like below when the formatted string contains When "{" and "}".

  Get-Content foo.csv | ConvertFrom-Csv -Header Name,Code,Address | `
  ForEach-Object {
    '\addaddress{{0}}{様}{{1}}{{2}}' -F $_.Name,$_.Code,$_.Address
Error formatting a string: Input string was not in a correct format..
At /home/xxxx/foobar.ps1:31 char:5
+     '\addaddress{{0}}{様}{{1}}{{2}}' -F $_.Name,$_.Code,$_.Address
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (\addaddress{0}{様}{1}{2}:String) [], RuntimeException
    + FullyQualifiedErrorId : FormatError


You should use "{{" and "}}" to output "{" and "}" with format operator, like:

  ForEach-Object {
    '\addaddress{{ {0} }}{{様}}{{ {1} }}{{ {2} }}' -F $_.Name,$_.Code,$_.Address