Am I right in thinking that if you have a service protected by SSL on the other side of an HTTP proxy which requires authentication that:

  • You authenticate using HTTP sending an unencrypted (albeit base64 encoded) username and password to the proxy (without which I receive a 407), which will then allow...
  • An HTTPS session to be opened to the service on the other side of the proxy.

1 Answer 1


This seems to cover it:

When tunneling SSL, the proxy must not have access to the data being
transferred in either direction, for sake of security. The proxy
merely knows the source and destination addresses, and possibly, if
the proxy supports user authentication, the name of the requesting


CONNECT is really a lower-level function than the rest of the HTTP
methods, kind of an escape mechanism for saying that the proxy should
not interfere with the transaction, but merely forward the data. This
is because the proxy should not need to know the entire URI that is
being accessed (privacy, security), only the information that it
explicitly needs (hostname and port number).


CONNECT home.netscape.com:443 HTTP/1.0
User-agent: Mozilla/4.0
Proxy-authorization: basic dGVzdDp0ZXN0

...SSL data...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.