An HTTP proxy is a server that receives a client's HTTP requests, forwards them to the destination server, and passes the responses back. For HTTPS sites, the client uses the CONNECT method to open a tunnel through the proxy, which then relays the encrypted traffic without being able to read it.

Because it only understands HTTP-level requests, an HTTP proxy can inspect and even modify the content of unencrypted traffic, which is why anything carrying sensitive data should travel over HTTPS, so the proxy only tunnels the encrypted traffic instead of reading it.

How an HTTP Proxy Handles a Request

  1. The client sends its request to the proxy instead of the website. For plain HTTP, it uses the full target URL; for HTTPS, it sends a CONNECT host:443 request.
  2. If the proxy requires a login, the client adds a Proxy-Authorization header.
  3. For HTTP, the proxy forwards the request to the destination. For CONNECT, it replies with a 2xx status and switches to tunnel mode.
  4. The response travels back through the proxy to the client.

Forward, Reverse and Transparent HTTP Proxies

  • Forward proxy: acts for clients and can hide their identity from websites. This is the type used for browsing and scraping.
  • Reverse proxy: acts on behalf of web servers, handling jobs such as load balancing and caching static content.
  • Transparent (intercepting) proxy: placed in the network path, so clients don't configure it and may not know it's there.