suppose I run a big webapp, let’s say written in ASP.net or some other such framework in which programmers may use in-memory session data. In practice, from my standpoint, the app is like a black box, but I can monitor data going in and out as well as log its interaction with the database. Well, I can do anything that can be done using a 3rd party tool that has no clue about the inner workings of any given webapp.
Now, suppose I want to market this webapp of mine to potential users and I am unhappy with that dumbest and least informative tool of them all, the “promotional video”. Instead I would like to offer potential customers a demo version experience on a “live” system, but I don’t want to force them to explore its complexity according to a big manual with screenshots. What I would really like to do is let them magically “jump” into the webapp state as it would have been after a whole bunch of actions were carried out. Then, when they are done exploring this particular scenario, they would “jump” into another scenario and so on (whatever changes and other damage they may have caused would be reset).
To use a simple analogy, let’s consider gmail. If I were selling gmail, let’s say I would want to let the user jump directly into the state where the first message in the Inbox is opened and the Reply button is pressed on it. Then maybe I would have them jump into the Forwarding screen and examine the process of setting up mail forwarding.
In a way, this is a lot like what could be achieved using a script running in browser functional testing app like Selenium. Except, my potential customers probably don’t have Selenium installed and wouldn’t want me to script their browser even if they did have it.
So is there a way to achieve the above using some existing technology that would implement “man in the middle”? Let’s say this MITM app, running on my server next to the app being demoed, would play a script of commands as if coming from the customer’s browser and transmit to the customer all session cookies being set by the server. Then once the script is done, the customer would be able to interact with the webapp as the same “session” as the script.
Is the above approach realistic given existing tools, handling of security issues and so on?
By way of editorial comment, I think that this version of the man in the middle with session being transferred to the customer’s browser is the dumbest and most obvious (if not necessarily most or at all feasible) way to attempt to solve this problem. If it doesn’t work, it would make sense to explore alternative approaches that don’t involve the transfer.