1

Why don't APT connect to HTTP proxy using HTTP CONNECT?

I want to use APT with an HTTP proxy, so I've exported the http_proxy variable with the address of my server http://10.10.10.10.

Now, my server expects a HTTP CONNECT request afterwards it starts proxying TCP traffic to the specified host.

However, Wireshark shows that APT doesn't issue HTTP CONNECT requests, but instead sends HTTP GET requests directly to the proxy server.

Why doesn't APT send HTTP CONNECT requests? Isn't that how a HTTP proxy is supposed to work?

Improve this question
5
  • IIRC CONNECTs are only necessary for HTTPS. Half-decent proxy servers should be able to handle GETs for plain HTTP.
    – muru
    Jul 16, 2019 at 7:05
  • @muru - what are IIRC CONNECTs? Never heard that before. Are you saying that CONNECT cannot be used with HTTP, but only HTTPS?
    – Shuzheng
    Jul 16, 2019 at 7:20
  • IIRC = "If I recall/remember correctly". No, CONNECTs can be used with HTTP, but I don't think many clients do that in practice. For example, neither curl nor wget do so.
    – muru
    Jul 16, 2019 at 7:25
  • Ohh, that clarifies things. Didn't know that HTTP CONNECT is the normal HTTP proxy behaviour for HTTPS, and that normal HTTP proxy behaviour for HTTP is to just forward the request e.g. HTTP GET. If you want points, I may ask you to write that down in an answer :-) Do you know if it's possible to force APT to use HTTP CONNECT for HTTP?
    – Shuzheng
    Jul 16, 2019 at 7:55
  • Nah, I didn't have the docs to back me up, but Stephen Kitt does. Also, I don't think it's possible to force the client to do so, not without modifying the code. (For example, with Firefox, if you return a "407 Proxy Authentication Required" status, it still responds with a GET with the supplied credentials, instead of using CONNECT.)
    – muru
    Jul 16, 2019 at 8:04

1 Answer 1

Reset to default
2

apt doesn’t use CONNECT for HTTP traffic because it doesn’t need to (and arguably, shouldn’t). It does use it for HTTPS traffic.

CONNECT is used to establish a tunnel through a proxy; typical use cases are to tunnel TLS or SSH traffic through a proxy.

It is not normally used for HTTP traffic. HTTP proxies are supposed to react in the same way as the hosts they proxy for; you’ll see them documented throughout the HTTP RFCs (look at the “Obsoletes” line in RFC 2616 to find them). Clients send the same requests to a proxy as they would send to the host.

If the proxy server allows it, a client can connect to its target host using CONNECT through the proxy, but that defeats some of the purposes of using a proxy in the first place. In particular, CONNECT tunnels aren’t cached.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.