# HTTP CONNECT

HTTP CONNECT is the request method a client sends to an HTTP proxy to ask for a TCP tunnel to a host and port, typically port 443. Once the proxy answers 200, the client speaks directly to the destination through that tunnel and negotiates TLS end to end, so the proxy sees only the destination name and encrypted bytes. It is how every HTTPS request travels through an HTTP proxy.


## The exchange

```http
CONNECT example.com:443 HTTP/1.1
Host: example.com:443
Proxy-Authorization: Basic dXNlcjpwYXNz

HTTP/1.1 200 Connection established

<TLS ClientHello to example.com follows>
```


## What it implies

- Certificates are the destination's own; nothing is re-signed. Certificate warnings through a proxy indicate interception, not normal operation.
- Targeting parameters must be in the proxy credentials, because the proxy never reads the encrypted request.
- Errors before the tunnel opens (407, 400, 502) come from the proxy; errors after it come from the destination.


## CONNECT to other ports

CONNECT can tunnel any TCP port, which is why an HTTP proxy can carry protocols other than HTTPS. Providers restrict some destinations (port 25 for mail is the classic exclusion) to prevent abuse.


## How it works at ProxShift

ProxShift gateways accept CONNECT on port 9000 and dedicated addresses on port 8000 to any TCP port except 25; the tunnel is passed through untouched and TLS is never terminated.

Source: https://proxshift.com/glossary/https-connect