HTTP CONNECT method

For HTTPS sites, an HTTP proxy does not read requests but only connects the program to the site. The program sends "CONNECT example.com:443", the proxy replies "200" and then simply passes encrypted data in both directions.

That is why it is safe to open sites with TLS through an HTTP proxy: the proxy cannot see the contents of the pages.

If the tunnel fails to open, the browser shows an error like ERR_TUNNEL_CONNECTION_FAILED. Causes and fixes are collected on the tunnel error page.

A tunnel opens only to allowed ports. In Prokso these include 80, 443, 8080 and 8443, while mail ports are closed.

The CONNECT exchange line by line

The program sends the proxy a request of three lines: CONNECT example.com:443 HTTP/1.1, Host: example.com:443 and Proxy-Authorization: Basic ... with the login data. The proxy checks the credentials, connects to the site and replies with a status line with code 200. After an empty line the connection becomes a tunnel, and the TLS handshake with the site starts. The Host header repeats the target because HTTP/1.1 requires it in every request.

Any code other than 2xx means that the tunnel did not open, and the answer came from the proxy, not from the site. In Prokso code 407 means wrong login details or exhausted traffic, and 503 marked NO_RAY means there is no free address for the chosen geo. What to do about 407 is described on the 407 error page.

How to see CONNECT in curl

Run curl -v -x http://LOGIN:PASSWORD@gw.prokso.com:823 https://example.com. Lines starting with > are what curl sent, and lines starting with < are the answers. First you will see > CONNECT example.com:443 HTTP/1.1 and the proxy's answer, then the TLS lines, and only after them the site's response. If there are no TLS lines after the proxy's code, the tunnel was not opened, and the code itself explains why. More examples are in the curl guide.

When CONNECT is not used

For addresses with http:// the program does not open a tunnel. It sends the proxy the full address, for example GET http://example.com/page HTTP/1.1, and the proxy forwards the request itself. In this case the page address and its contents are visible to the proxy, because there is no encryption.

In curl, the -p (--proxytunnel) option forces a tunnel for http:// addresses too.