HaxeFoundation / HaxeFoundation/haxe

Http.PROXY broken on HTTPS URL

Open
#8,434 2 comments 1 reaction 0 assignees View on GitHub
standard library
Dominant language
Haxe
Stars
6.9k
Forks
715
Avg merge
2d 2h
Merged PRs (30d)
11

Description

Related to #6204.

Haxelib 3.4.0 doesn't work behind a plain HTTP proxy: `Http.request` **always** use a SSL socket if the URL begins with `https://`, and **always not** if the URL begins with `http://`. Thus `https://` over a proxy is misinterpreted as SSL to proxy and plain HTTP to remote server.

Haxelib has https://lib.haxe.org hard-coded and actually makes an **unencrypted** HTTP request over an SSL connection to the proxy. My proxy has no SSL support and haxelib fails.

#6204 asks for secure request over secure proxies. In contrast, my configuration requires secure requests to be made over a plain proxy.

Six combinations exist under this scenario:
1. HTTP request, HTTP proxy, GET method
2. HTTP request, SSL proxy, GET method
3. HTTPS request, HTTP proxy, GET method
4. HTTPS request, HTTP proxy, CONNECT method
5. HTTPS request, SSL proxy, GET method
6. HTTPS request, SSL proxy, CONNECT method

of which none except 1 and 2 is currently supported. (4 requires sending data before SSL handshake. 6 is SSL over SSL. Both can be messy to implement, but are important to security.)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.