curl doesn't use "https_proxy" for websockets "wss" requests

[candrews]

I did this

$ https_proxy='http://notvalid' curl 'wss://google.com.com/service'
curl: (22) Refused WebSockets upgrade: 302
[22]

I expected the following

curl: (5) Could not resolve proxy: notvalid
[5]

curl/libcurl version

curl 8.3.0 (x86_64-pc-linux-musl) libcurl/8.3.0 OpenSSL/3.1.3 zlib/1.2.13 libssh2/1.10.0 nghttp2/1.55.1
Release-Date: 2023-09-13
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS HSTS HTTP2 HTTPS-proxy IPv6 Largefile libz NTLM NTLM_WB SSL threadsafe TLS-SRP UnixSockets

operating system

Fedora Linux 39

[dfandrich]

I'm not sure curl supports WebSockets over proxy yet.

[dfandrich]

Actually, it does seem to use the ws_proxy and wss_proxy environment variables to set a WebSocket proxy server.

[candrews]

The --proxy option does work as expected with Websockets.

Since Websockets use HTTP/HTTPS, I think the HTTP/HTTPS proxy configuration should apply to Websockets connections.

[dfandrich]

Are you aware of any other programs that do that?

[candrews]

Firefox uses the http proxy environment variables for websockets connections. Their UI also has settings http/https/socks only, notably it does not have a separate option to configure websockets requests.

It's well known that Websockets is an HTTP based protocol, so I expected it to use HTTP configuration.

[dfandrich]

WebSockets isn't any more an HTTP protocol than GRPC, which uses the same upgrade mechanism to switch from HTTP to use its own completely different protocol. It will be bagder's call whether or not it makes sense to use http_proxy for WebSockets as well. If multiple other programs do it, then it's an easier sell.

[bagder]

If multiple other programs do it, then it's an easier sell.

Agreed. It makes sense to follow established behaviors.

I find it a little strange to support http_proxy and https_proxy for ws and wss simply because it breaks the previously established pattern. It has always been [url scheme]_proxy to check for the proxy, but this asks for something else.

[bagder]

We might want to check wss_proxy first, and if that is not set, fall back to checking https_proxy...