0

I wonder what the advantages of http CONNECT request over TLS are.

I understand that the CONNECT request data from client to proxy is encrypted. But I want to know more specific advantages.

Which attack is possible when the data between them is NOT encrypted? Is it fatal and must I establish SSL session between client and proxy?

0

The main advantage of accessing the proxy with TLS is that somebody who can sniff the traffic between the client and the proxy cannot see sensitive or private data. This means of course the domain the client is accessing (i.e. endpoint of the requested tunnel) but also any credentials used for proxy authentication.

Additionally TLS might also protect the payload between client and proxy. The payload of CONNECT is not always HTTPS: For example plain WebSockets (i.e. ws://) will use CONNECT when a HTTP proxy is involved and WebRTC might also fall back to it if no better way (i.e. direct UDP connections or using TURN) is possible. But note that this protection will only happen between client and proxy and the connection between proxy and will not provide any additional protection between proxy and server.

  • Thanks. Then is it common case to implement TLS session between client and proxy, between proxy and server, and between client and server? – zzinny Oct 21 at 12:56
  • @zzinny: TLS between proxy and server is only done as a side effect of TLS interception. TLS between client and server is very common (i.e. HTTPS). TLS between client and proxy is uncommon and often unsupported. – Steffen Ullrich Oct 21 at 14:00
  • Thanks for detailed answer :) – zzinny Oct 21 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.