HTTP Proxies & Tunnels

RFC 9110 specifies HTTP proxy forwarding and the CONNECT method for establishing end-to-end encrypted TCP tunnels through intermediary proxies.

HTTP CONNECT Tunneling

When connecting to an HTTPS destination through an HTTP proxy:

Client connects to proxy IP:port via TCP.
Client sends plaintext:

http

CONNECT httpbun.com:443 HTTP/1.1
Host: httpbun.com:443

Proxy establishes TCP connection to destination and returns 200 Connection Established.
Client performs TLS 1.3 handshake directly with destination through the proxy tunnel.

The proxy never sees the plaintext TLS payload or cryptographic keys.

Forward Proxy vs Reverse Proxy

Forward Proxy: Client-side proxy directing outgoing traffic to external destinations.
Reverse Proxy: Server-side gateway terminating client requests and forwarding them to internal upstream microservices.

Client Usage

zig

var client = httpx.Client.init(allocator, io, .{
    .proxy = "http://corporate-proxy.corp:8080",
});
defer client.deinit();

const res = try client.get("https://httpbun.com/get", .{});
defer res.deinit();