HaxeFoundation / HaxeFoundation/haxe
Http.PROXY broken on HTTPS URL
- Dominant language
- Haxe
- Stars
- 6.9k
- Forks
- 715
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 11
Description
Related to #6204.
Haxelib 3.4.0 doesn't work behind a plain HTTP proxy: `Http.request` **always** use a SSL socket if the URL begins with `https://`, and **always not** if the URL begins with `http://`. Thus `https://` over a proxy is misinterpreted as SSL to proxy and plain HTTP to remote server.
Haxelib has https://lib.haxe.org hard-coded and actually makes an **unencrypted** HTTP request over an SSL connection to the proxy. My proxy has no SSL support and haxelib fails.
#6204 asks for secure request over secure proxies. In contrast, my configuration requires secure requests to be made over a plain proxy.
Six combinations exist under this scenario:
1. HTTP request, HTTP proxy, GET method
2. HTTP request, SSL proxy, GET method
3. HTTPS request, HTTP proxy, GET method
4. HTTPS request, HTTP proxy, CONNECT method
5. HTTPS request, SSL proxy, GET method
6. HTTPS request, SSL proxy, CONNECT method
of which none except 1 and 2 is currently supported. (4 requires sending data before SSL handshake. 6 is SSL over SSL. Both can be messy to implement, but are important to security.)
Contributor guide
Assessment
This issue has not been assessed yet.