Explicit HTTP Proxy Styles

Proxy comparison #

Proxy behavior ↓ / Client → proxy hop →	HTTP to proxy	HTTPS to proxy
Forward proxy — client sends absolute-form requests, e.g. `GET http://target/path`	Pros: Simplest and broadly supported; proxy can authenticate, cache, filter, route, and log HTTP requests; low protocol overhead. Cons: The client-to-proxy request, headers, URL, and body are plaintext unless the target payload is separately protected; unsafe across untrusted local networks.	Pros: Encrypts the client-to-proxy hop, hiding proxy credentials and HTTP request details from the local network; proxy retains HTTP-aware capabilities after TLS terminates. Cons: More TLS setup/CPU cost; proxy still sees and can modify request contents; less universally deployed/configured than an HTTP proxy URL.
Tunnel proxy — client sends `CONNECT host:port`, then streams bytes	Pros: Standard, widely compatible way to reach HTTPS origins through a proxy; end-to-end TLS remains between client and destination; proxy normally cannot inspect the HTTP payload. Cons: `CONNECT` request and destination host/port are plaintext on the client-to-proxy hop; proxy traffic is observable and may be blocked/limited; no HTTP caching or request-level policy without TLS interception.	Pros: Encrypts both the `CONNECT` setup—including proxy authentication and destination authority—and the tunnel hop; with HTTPS inside the tunnel, provides layered protection across an untrusted local network. Cons: Two TLS layers and extra setup overhead; harder to debug and somewhat less compatible; proxy still observes connection metadata after decrypting its outer TLS layer, and policies remain mostly connection-level.

“HTTPS to proxy” means the proxy itself is reached over TLS—such as an https://proxy.example:443 proxy configuration. It is independent of whether the target site uses HTTPS.

Example HTTP transcripts #

http

# Forward proxy over HTTP: these HTTP bytes are visible on the client-to-proxy hop.
Client -> proxy
GET http://origin.example/reports/42 HTTP/1.1
Host: origin.example
Proxy-Authorization: Basic <credentials>

Proxy -> client
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 11

{"ok":true}

http

# Forward proxy over HTTPS: the wire carries TLS records to proxy.example.
# After TLS decryption at the proxy, the HTTP exchange is:
Client -> proxy
GET http://origin.example/reports/42 HTTP/1.1
Host: origin.example
Proxy-Authorization: Basic <credentials>

Proxy -> client
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 11

{"ok":true}

http

# Tunnel proxy over HTTP: CONNECT headers are visible on the client-to-proxy hop.
Client -> proxy
CONNECT origin.example:443 HTTP/1.1
Host: origin.example:443
Proxy-Authorization: Basic <credentials>

Proxy -> client
HTTP/1.1 200 Connection Established

# Subsequent bytes are an end-to-end TLS session with origin.example;
# the origin HTTP requests are not exposed to the proxy.

http

# Tunnel proxy over HTTPS: the wire carries outer TLS records to proxy.example.
# After outer TLS decryption at the proxy, the HTTP exchange is:
Client -> proxy
CONNECT origin.example:443 HTTP/1.1
Host: origin.example:443
Proxy-Authorization: Basic <credentials>

Proxy -> client
HTTP/1.1 200 Connection Established

# Subsequent bytes carry an inner TLS session with origin.example inside the
# outer TLS connection; origin HTTP requests remain encrypted from the proxy
# and end-to-end to origin.example.

Explicit HTTP Proxy Styles

Proxy comparison #

Example HTTP transcripts #

Comments