I wonder what the advantages of http CONNECT request over TLS are.
I understand that the CONNECT request data from client to proxy is encrypted. But I want to know more specific advantages.
Which attack is possible when the data between them is NOT encrypted? Is it fatal and must I establish SSL session between client and proxy?
The main advantage of accessing the proxy with TLS is that somebody who can sniff the traffic between the client and the proxy cannot see sensitive or private data. This means of course the domain the client is accessing (i.e. endpoint of the requested tunnel) but also any credentials used for proxy authentication.
Additionally TLS might also protect the payload between client and proxy. The payload of CONNECT is not always HTTPS: For example plain WebSockets (i.e. ws://) will use CONNECT when a HTTP proxy is involved and WebRTC might also fall back to it if no better way (i.e. direct UDP connections or using TURN) is possible. But note that this protection will only happen between client and proxy and the connection between proxy and will not provide any additional protection between proxy and server.
