An HTTP proxy can read and forward plain HTTP requests. But what about encrypted HTTPS traffic? If the proxy cannot read the content, how will it forward it? The answer is the CONNECT method: the standard way of telling the proxy "open a raw TCP tunnel to this address and then stay out of it".
How Is the Tunnel Established?
After the 200 response, the proxy becomes a "pipe": it passes the incoming bytes to the other side exactly as they are and never looks at the content.
The moment the CONNECT response is 200 Connection established , the proxy stops speaking HTTP. The bytes that follow are the TLS handshake, and the proxy cannot interpret them — it only carries them.
What Does the Proxy See in a CONNECT Tunnel?
In other words, HTTPS hides what you are doing but does not hide where you are going . This distinction is critically important when evaluating proxy privacy.
We covered metadata leakage and logging in detail in proxy logs article .
The Difference Between CONNECT and Absolute-URI
In plain HTTP, a different request form is sent to the proxy. The two should not be confused:
| Plain HTTP (absolute-URI) | HTTPS (CONNECT) | |
|---|---|---|
| Request line | GET http://site/yol HTTP/1.1 | CONNECT site:443 HTTP/1.1 |
| Can the proxy see the content | Yes, completely | No |
| Can it add headers | Yes | No |
| Can it cache | Yes | No |
| For each request | A new request line | One tunnel, many requests |
This is why headers such as X-Forwarded-For can only be added in plain HTTP traffic; in HTTPS the proxy cannot touch the headers.
Why Is CONNECT Restricted?
CONNECT is the authority to tell the proxy "open a raw TCP connection to any address". If it is not restricted, the proxy turns into an open relay. That is why most proxy configurations limit CONNECT to specific ports only:
SMTP ports are blocked in order to prevent spam abuse. If you need to carry e-mail traffic, you have to ask your provider for special permission.
Common Errors
The ERR_TUNNEL_CONNECTION_FAILEDyou see in the browser means that the CONNECT request received a response other than 200. To see the detail, try it with curl.
Inspecting from the Command Line
The last command shows how plain the protocol is: sending a few lines of text and receiving a 200 response is enough.
TLS Interception (SSL Inspection)
Instead of establishing the tunnel, some corporate proxies step into the middle: they connect to the target themselves and present the client with a fake certificate signed by the organization's root certificate. When this is done, the proxy can read the encrypted content as well.
Click the padlock icon in the browser and look at the organization that issued the certificate. If you see the organization's name instead of the public certificate authority you expected, TLS interception is being applied. We covered the topic in our transparent proxy article .
Performance Note: Tunnel Reuse
Once a CONNECT tunnel has been established, several requests to the same target can pass through the same tunnel. This means paying the handshake cost only once. Keeping keep-alive enabled in your client provides a noticeable speed gain in CONNECT-based traffic.
The first request is expensive, the following ones are cheap. A client that opens a new connection for every request pays this difference over and over.
Summary
CONNECT is a simple but powerful mechanism that lets an HTTP proxy carry encrypted traffic. Once the tunnel is established, the proxy cannot see the content; it only knows the target domain name, the time and the amount of bytes. Port policies restrict CONNECT in order to prevent abuse. Reusing the tunnel is critical for performance. To verify your configuration, use our proxy checker tool you can use.