Why don't APT connect to HTTP proxy using HTTP CONNECT?

I want to use APT with an HTTP proxy, so I've exported the http_proxy variable with the address of my server

Now, my server expects a HTTP CONNECT request afterwards it starts proxying TCP traffic to the specified host.

However, Wireshark shows that APT doesn't issue HTTP CONNECT requests, but instead sends HTTP GET requests directly to the proxy server.

Why doesn't APT send HTTP CONNECT requests? Isn't that how a HTTP proxy is supposed to work?


1 Answer 1


apt doesn’t use CONNECT for HTTP traffic because it doesn’t need to (and arguably, shouldn’t). It does use it for HTTPS traffic.

CONNECT is used to establish a tunnel through a proxy; typical use cases are to tunnel TLS or SSH traffic through a proxy.

It is not normally used for HTTP traffic. HTTP proxies are supposed to react in the same way as the hosts they proxy for; you’ll see them documented throughout the HTTP RFCs (look at the “Obsoletes” line in RFC 2616 to find them). Clients send the same requests to a proxy as they would send to the host.

If the proxy server allows it, a client can connect to its target host using CONNECT through the proxy, but that defeats some of the purposes of using a proxy in the first place. In particular, CONNECT tunnels aren’t cached.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .