ws:// over HTTP proxy should use CONNECT

[bagder]

I did this

curl -x [HTTP proxy] ws://another.example.com/

This makes curl send something like this to the proxy:

GET ws://another.example.com/ HTTP/1.1
Host: another.example.com
...

I expected the following

It should send a CONNECT HTTP request connecting to the target:

CONNECT another.example.com:80 HTTP/1.1
Host: another.example.com
...

curl/libcurl version

curl 8.20.0 (and git master)

operating system

any

[icing]

Apache wants to see the ws: scheme to allow a connection upgrade. Otherwise it will not forward the Upgrade: header to the backend for HTTP/1.1.

[bagder]

Oh, ok. So maybe not so borked... Any clue if this is common thing for other proxies?

[icing]

No idea. But maybe @mhils has an opinion?

My guess would be that Connection: Upgrade is hop-by-hop and the proxy needs a way to know that the client wants to talk websocket end-to-end. It by itself cannot upgrade the frontend connection to ws:.

[mhils]

mitmproxy will reject GET ws://... with Bad HTTP request line or Invalid request scheme. My naive take on this is that it's a regular HTTP request as long as we haven't received a valid 101 response.

FWIW https://datatracker.ietf.org/doc/html/rfc6455#section-4.1:

If the client is configured to use a proxy when
using the WebSocket Protocol to connect to host /host/ and port
/port/, then the client SHOULD connect to that proxy and ask it
to open a TCP connection to the host given by /host/ and the port
given by /port/.

[icing]

So, we should tunnel it. Makes sense to me. Thanks!

[bagder]

I updated the bug description accordingly.

[icing]

Implemented in #21691