1

Is there a standard for determining the anonymity level of a proxy? After reading various articles, I have come to the conclusion that you determine the anonymity level by analyzing the headers but I have not found a standard as for which headers to analyse.

2
  • As far as I know if the proxy doesn't add nor alter any "Via" or "X-Forwarded-For" headers then it's an anonymous proxy. – user42178 Dec 19 '14 at 11:47
  • @AndréDaniel Yes, I think you are right. "Via", "Forwarded", "X-Forwarded-For" and "Client-ip" seems to be the headers that you should analyse. Source. – unethicalunicorn Dec 19 '14 at 17:21
1

Most common way of determining the proxy is by analyzing the headers such as HTTP_VIA, HTTP_X_FORWARDED_FOR, or HTTP_FORWARDED (which you've already mentioned). At least, almost all web based proxy detection applications such as this and this analyze these headers to detect whether or not the request has came from a proxy. Try visiting those web applications using with an Anonymous proxy (such as Tor) and they wont be able to detect those headers in the request. This is because Tor does not attach typical proxy headers (such as Via or X-Forwarded-For), or in any other way modify HTTP requests or responses.

I don't know about a particular standard, but according to this Wikipedia article, there are 3 basic types of proxies depending on their level of anonymity:

  • Fully anonymous proxies - Such proxies do not change request fields and look like real browser. Your real IP is also hidden of
    course. People that administer internet servers will think that you
    are not using any proxies.
  • Anonymous proxies - Do not show a real IP but change the request fields, so it is very easy to detect that a proxy is being used by log analysis. You are still anonymous, but some server administrators restrict proxy requests.
  • Transparent proxies (not anonymous, simply HTTP) - Change the request fields and they transfer the real IP. Such proxies are not
    applicable for security and privacy while surfing on the web. You can use them only for network speed improvement.
1
  • I did never found a standard but I have now concluded that the following headers are of interest: 'CLIENT_IP', 'FORWARDED', 'FORWARDED_FOR', 'FORWARDED_FOR_IP', 'HTTP_CLIENT_IP', 'HTTP_FORWARDED', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED_FOR_IP', 'HTTP_PROXY_CONNECTION', 'HTTP_VIA', 'HTTP_X_FORWARDED', 'HTTP_X_FORWARDED_FOR', 'VIA', 'X_FORWARDED', 'X_FORWARDED_FOR' – unethicalunicorn Dec 25 '14 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.