Can the core Java HttpClient proxy through a TLS Proxy?

Question

I am trying to setup a HttpClient to proxy requests through a HTTPS authenticated proxy.

It seems the Java HttpClient can only proxy over http and therefore the proxy credentials are sent in plaintext to the proxy.

I have opened the proxy on port 8443 to accept http and this works fine:

System.setProperty("jdk.http.auth.tunneling.disabledSchemes", "");
String user = "username";
String password = "password";

Authenticator authenticator = new ProxyAuthenticator(user, password);
Authenticator.setDefault(authenticator);

HttpClient httpClient = HttpClient.newBuilder()
    .sslContext(getSSLContextTrustAny())
    .version(HttpClient.Version.HTTP_1_1)
    .proxy(ProxySelector.of(new InetSocketAddress("my.proxy", 8443)))
    .authenticator(Authenticator.getDefault())
    .build();

String uri = "https://ensc1aqsjv0asda.x.pipedream.net/";
String msg = "test-msg";

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(uri))
    .POST(HttpRequest.BodyPublishers.ofString(msg))
    .build();

HttpResponse<?> response = httpClient.send(request, HttpResponse.BodyHandlers.discarding());

System.out.println(response);
System.out.println(response.headers());

(Note: getSSLContextTrustAny() returns an SSLContext that trusts any cert as the proxy is using a self signed CA)

However, when I set the port to 443 (which is open), the request just times out. I suspect the client is trying to proxy to http://my.proxy:443 instead of over TLS to https://my.proxy:443

Is it possible to make the client use https for proxying?

daniel · Accepted Answer · 2022-05-12 14:57:34Z

0

No - this is not supported. It is possible to tunnel an HTTPS connection to a server through a clear connection to a proxy, but it is not possible to proxy a clear HTTP connection to a server through an encrypted connection to a proxy.

answered May 12, 2022 at 14:57

daniel

3,4381 gold badge11 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

donal Over a year ago

Thanks @daniel , is this just a limitation of the HttpClient or Java in general? If I move to the Apache client or the oldUrlConnection, will it be possible?

daniel Over a year ago

I believe the legacy stack (URL.openConnection(), java.net.HttpURLConnection javax.net.ssl.HttpsURLConnection) behave the same. I don't know for other clients.

Collectives™ on Stack Overflow

Can the core Java HttpClient proxy through a TLS Proxy?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related