Is there a standard for determining the anonymity level of a proxy? After reading various articles, I have come to the conclusion that you determine the anonymity level by analyzing the headers but I have not found a standard as for which headers to analyse.
Most common way of determining the proxy is by analyzing the headers such as
HTTP_VIA, HTTP_X_FORWARDED_FOR, or HTTP_FORWARDED (which you've already mentioned). At least, almost all web based proxy detection applications such as this and this analyze these headers to detect whether or not the request has came from a proxy. Try visiting those web applications using with an Anonymous proxy (such as Tor) and they wont be able to detect those headers in the request. This is because Tor does not attach typical proxy headers (such as
Via or X-Forwarded-For), or in any other way modify HTTP requests or responses.
I don't know about a particular standard, but according to this Wikipedia article, there are 3 basic types of proxies depending on their level of anonymity:
- Fully anonymous proxies - Such proxies do not change request fields and look like real browser. Your real IP is also hidden of
course. People that administer internet servers will think that you
are not using any proxies.
- Anonymous proxies - Do not show a real IP but change the request fields, so it is very easy to detect that a proxy is being used by log analysis. You are still anonymous, but some server administrators restrict proxy requests.
- Transparent proxies (not anonymous, simply HTTP) - Change the request fields and they transfer the real IP. Such proxies are not
applicable for security and privacy while surfing on the web. You can use them only for network speed improvement.