# WebRTC leak

A WebRTC leak occurs when a browser configured to use a proxy for web traffic still discloses the device's real public or local IP addresses through WebRTC, the real-time communication API, because WebRTC gathers connection candidates directly rather than through the proxy. Any page can trigger it with JavaScript, so a browser session through a proxy is only as private as its WebRTC settings.


## How to prevent it

| Browser | Setting |
| --- | --- |
| Firefox | `media.peerconnection.enabled = false` in about:config, or the network.proxy policy to force proxied candidates only |
| Chrome / Chromium | WebRTC IP handling policy "disable non-proxied UDP" (extension or enterprise policy); anti-detect browsers expose it as a toggle |
| Headless automation | Launch flags that disable WebRTC, or block STUN servers at the network level |


## Testing

Load a WebRTC leak test page through the proxy: the only address listed must be the exit. Scripts and non-browser clients are not affected; the leak is a browser feature.


## How it works at ProxShift

Because ProxShift is TCP-only and never touches the browser, WebRTC candidates cannot travel through it; the fix is on the browser side, and the guides list the settings per browser.

Source: https://proxshift.com/glossary/webrtc-leak