Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have my code sending a request to a URL such as: https://www.example.com while connecting over a proxy, with the proxy URL being: http://www.example_proxy.com
Since my site is using HTTPS and my proxy is using HTTP, is this a problem? Please explain if this is secure.
This can be secure.
The client can issue a CONNECT request to the proxy, which basically creates a tunnel between the client and the destination server. This way, the client can set up an SSL connection through the proxy, and the proxy will see encrypted traffic. Even if someone else impersonates the proxy, he will only see encrypted traffic.
Another possibility is to do a GET request to the proxy. This asks the proxy to retrieve a page on your behalf. This is usually only used for HTTP traffic, but may also work for HTTPS traffic. If your client uses this method to retrieve a page, the proxy can view all data. Furthermore, a man-in-the-middle attacker may impersonate the proxy and also see all data.
If you use an HTTPS connection to the proxy, it is much harder for a man-in-the-middle attacker to impersonate your proxy.
It also depends on your definition of client too. As you would code something(not a known browser) to not validate the given certificate and that could be a kind of self-signed by the proxy you mentioned.
But as the client doesn't check the stuffs, proxy could fool the client.
Plus keep an eye over the redirects, you may ask for facebook.com(assume no HSTS yet), but the result could be redirected to something like fb.example_proxy.com even in https with a trusted certificate. So as you don't take about the path you had redirected, the proxy now can have the data you think you are sending to teh facebook.
I had some issues then with the firefox, where firefox marks some completely secure with trusted certificates as insecure connections(even google.com). I mean even a legendary client like firefox could come with this kind of bug, and also it could be vice-versa.
https://URL in plain to the proxy then the code is not properly using a proxy and the connection is not secured. Instead you should need to useCONNECTrequest to build a tunnel. Since with the currently given details it is unknown what your code really does it is hard to tell if you are doing it right (safe) or wrong (unsafe).