91

I'm building a WebClient library. Now I'm implementing a proxy feature, so I am making some research and I saw some code using the CONNECT method to request a URL.

But checking it within my web browser, it doesn't use the CONNECT method but calls the GET method instead.

So I'm confused. When I should use both methods?

Sebastian Zartner
  • 18,808
  • 10
  • 90
  • 132
Alexsandro
  • 1,191
  • 1
  • 14
  • 22

4 Answers4

124

TL;DR a web client uses CONNECT only when it knows it talks to a proxy and the final URI begins with https://.

When a browser says:

CONNECT www.google.com:443 HTTP/1.1

it means:

Hi proxy, please open a raw TCP connection to google; any following bytes I write, you just repeat over that connection without any interpretation. Oh, and one more thing. Do that only if you talk to Google directly, but if you use another proxy yourself, instead you just tell them the same CONNECT.

Note how this says nothing about TLS (https). In fact CONNECT is orthogonal to TLS; you can have only one, you can have other, or you can have both of them.

That being said, the intent of CONNECT is to allow end-to-end encrypted TLS session, so the data is unreadable to a proxy (or a whole proxy chain). It works even if a proxy doesn't understand TLS at all, because CONNECT can be issued inside plain HTTP and requires from the proxy nothing more than copying raw bytes around.

But the connection to the first proxy can be TLS (https) although it means a double encryption of traffic between you and the first proxy.

Obviously, it makes no sense to CONNECT when talking directly to the final server. You just start talking TLS and then issue HTTP GET. The end servers normally disable CONNECT altogether.

To a proxy, CONNECT support adds security risks. Any data can be passed through CONNECT, even ssh hacking attempt to a server on 192.168.1.*, even SMTP sending spam. Outside world sees these attacks as regular TCP connections initiated by a proxy. They don't care what is the reason, they cannot check whether HTTP CONNECT is to blame. Hence it's up to proxies to secure themselves against misuse.

Koray Tugay
  • 22,894
  • 45
  • 188
  • 319
kubanczyk
  • 5,184
  • 1
  • 41
  • 52
94

A CONNECT request urges your proxy to establish an HTTP tunnel to the remote end-point. Usually is it used for SSL connections, though it can be used with HTTP as well (used for the purposes of proxy-chaining and tunneling)

CONNECT www.google.com:443

The above line opens a connection from your proxy to www.google.com on port 443. After this, content that is sent by the client is forwarded by the proxy to www.google.com:443.

If a user tries to retrieve a page http://www.google.com, the proxy can send the exact same request and retrieve response for him, on his behalf.

With SSL(HTTPS), only the two remote end-points understand the requests, and the proxy cannot decipher them. Hence, all it does is open that tunnel using CONNECT, and lets the two end-points (webserver and client) talk to each other directly.

Proxy Chaining:

If you are chaining 2 proxy servers, this is the sequence of requests to be issued.

GET1 is the original GET request (HTTP URL)
CONNECT1 is the original CONNECT request (SSL/HTTPS URL or Another Proxy)

User Request ==CONNECT1==> (Your_Primary_Proxy ==CONNECT==> AnotherProxy-1 ... ==CONNECT==> AnotherProxy-n) ==GET1(IF is http)/CONNECT1(IF is https)==> Destination_URL
Alexsandro
  • 1,191
  • 1
  • 14
  • 22
Anirudh Ramanathan
  • 46,179
  • 22
  • 132
  • 191
  • So, are you told me CONNECT method limit to HTTPS( default port 443) requests? – Alexsandro Jul 28 '12 at 03:27
  • 2
    No not at all. SSL could be running on a different port. Port 443 is the most commonly used port for SSL. `CONNECT` is used for proxying HTTPS requests compulsorily, and using it for HTTP is possible as well, but not necessary. – Anirudh Ramanathan Jul 28 '12 at 03:30
  • Great, now, if I want implement a chain proxy? Client -> PROXY -> Another PROXY -> URL. Should I user CONNECT or GET? – Alexsandro Jul 28 '12 at 03:33
  • 1
    See updated answer. You would first issue a CONNECT to each proxy you are chaining to, sequentially. When you get a `200 Established` response from each proxy you are chaining, finally send the original `GET` or `CONNECT` – Anirudh Ramanathan Jul 28 '12 at 03:38
  • So, We can say CONNECT is "Usually is it used for SSL connections **and proxy chain**". Nice! I will test it, thank's in advance. – Alexsandro Jul 28 '12 at 03:45
  • @AnirudhRamanathan who start this connect request(client or proxy server), for ex: in my android mobile, i am connected with proxy server and my app is using HTTPUrlConenction to make https request to https://domain/path/ i have requested for get request. how connect will come in between, can you please explain this scenerio – Aman Jain Jul 15 '17 at 07:51
  • For every https request, does the browser always fire the CONNECT prior to the other HTTP methods? – variable May 13 '20 at 17:33
20

As a rule of thumb GET is used for plain HTTP and CONNECT for HTTPS

There are more details though so you probably want to read the relevant RFC-s

http://www.ietf.org/rfc/rfc2068.txt http://www.ietf.org/rfc/rfc2817.txt

anttix
  • 7,709
  • 1
  • 24
  • 25
  • Thanks @anttix, really I just make a test, I saw CONNECT method used when I request HTTPS URL. Now, I'm testing proxy chain, talking to DarkXphenomenon above, CONNECT method will help me do to a proxy chain using CONNECT because GET don't work. – Alexsandro Jul 28 '12 at 03:54
0

The CONNECT method converts the request connection to a transparent TCP/IP tunnel, usually to facilitate SSL-encrypted communication (HTTPS) through an unencrypted HTTP proxy.