HTTP CONNECT Tunneling
The CONNECT method asks a proxy to open a raw TCP tunnel to a destination, letting TLS and other protocols pass through without the proxy terminating or inspecting the payload.
Definition
CONNECT is an HTTP method that converts a proxy connection into an opaque pipe. The client sends CONNECT with a host and port, the proxy establishes the upstream TCP connection, and upon 200 the remaining bytes flow end-to-end. TLS inside the tunnel is negotiated with the real destination, keeping keys away from the proxy.
Context and scope
The mechanism behind HTTPS through corporate proxies, secure WebSocket relay, and protocols like PostgreSQL or SSH over HTTP egress. Also the surface for proxy authorization policies.
Common misconceptions
- The proxy sees CONNECT traffic content — it sees only the destination host and port, then opaquely relays bytes
- CONNECT requires HTTP semantics — once established the tunnel carries any TCP protocol
- All proxies allow CONNECT to any port — allowlists of methods and ports are policy, and misconfiguration is common
Anti-patterns
- Allowing CONNECT to arbitrary internal addresses and ports, turning the proxy into an SSRF-style pivot
- Intercepting CONNECT traffic without telling clients, breaking certificate validation and pinning
- Relying on CONNECT keepalive semantics that some proxies silently drop after idle periods
Related concepts
Related examples
Authoritative source
What it is
A forward proxy can either relay HTTP requests or blind-tunnel them. CONNECT requests the blind mode: the proxy connects upstream, then copies bytes in both directions. The client then runs TLS or any TCP protocol through the pipe, end-to-end with the real server.
How it works
The request carries the authority form target, host plus port, and the proxy answers 2xx to open the pipe. Proxy-Authorization applies at CONNECT time, not per inner request. Half-close and idle behavior vary across implementations, which is why heartbeat or reconnect logic still belongs in the tunneled protocol.
When to use it
Egress policies that must allow TLS without terminating it, browser access through explicit proxies, and tunneling databases or SSH through an HTTP-only egress. Environments that intercept TLS use a different mechanism: a MITM certificate with clients configured to trust it.
Pitfalls
The destination allowlist is the security boundary; open CONNECT to internal ranges creates a pivot into the private network. Proxies that time out tunnels break long-lived sessions without notice. Observability is limited to byte counts and durations, so audit logging must capture the CONNECT target.