mitmproxy ignore-hosts cannot be accessed with firefox

Question

I tried to use --ignore-hosts to ignore some domains like

mitmproxy --ignore-hosts .facebook.com

I assume that "--ignore-hosts" means: ignored hosts will not be intercepted and would be just forwarded/passthru.

I can now proxy all sites with mitmproxy's CA and inspect the traffic. However, I cannot browse facebook.com with Firefox at all and will get

    Secure Connection Failed

    An error occurred during a connection to www.facebook.com.

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the web site owners to inform them of this problem.

is it due to firefox? Or I understand it wrong and mitmproxy just refuse to process "ignored hosts"?!

Answer 1

The --ignore-hosts option expects a regular expression. If you set it to .facebook.com it does not match facebook.com because the regular expression requires one additional character at the beginning.

If you want to ignore facebook.com, and all of it's subdomains you have to use the following regular expression:

mitmproxy --ignore-hosts '^(.+\.)?facebook\.com:443$'

See also https://docs.mitmproxy.org/stable/howto-ignoredomains/#tutorial