HTTP proxy

An HTTP proxy receives HTTP requests from a client (e.g., a web browser), forwards them to the target server, and returns the server's response to the client. The proxy can modify both requests and responses, enabling features such as caching, content filtering, and anonymity. The HTTP/1.1 specification (RFC 7230) defines the semantics of proxy behavior, including the handling of Via headers to track the request path¹. Proxies may be deployed as forward proxies (serving clients) or reverse proxies (serving servers), and they operate at the application layer of the OSI model.

Forward proxies sit between client machines and the internet, often used for content filtering, caching, and anonymizing traffic. Reverse proxies sit in front of web servers, providing load balancing, SSL termination, and caching to improve performance and security. Transparent proxies intercept network traffic without requiring client configuration, while non-transparent (or explicit) proxies require clients to set proxy settings. The HTTP CONNECT method allows a proxy to establish tunnels for HTTPS traffic, enabling secure communication through the proxy².

HTTP proxies are widely used for caching frequently accessed web content, reducing bandwidth and latency. They enable content filtering in organizations to block malicious or inappropriate sites, and anonymization by hiding the client's IP address from the target server. Reverse proxies distribute incoming requests across multiple backend servers, improving reliability and scalability. Corporations and educational institutions often deploy proxies to enforce acceptable use policies and monitor traffic³.

While HTTP proxies can enhance privacy by masking client IPs, they may also introduce security risks if not properly configured. Transparent proxies can inadvertently expose traffic if they do not correctly handle HTTPS tunneling. The use of CONNECT for HTTPS creates an encrypted tunnel, but the proxy can still inspect metadata. Malicious proxies can intercept or modify data, so users should only trust proxies from reputable providers. Organizations should implement authentication and encryption between the client and proxy to prevent unauthorized access⁴.

Proxy Auto-Configuration (PAC) files allow clients to automatically select a proxy based on URL patterns, simplifying deployment in large networks. Web Proxy Auto-Discovery (WPAD) automates PAC file retrieval via DHCP or DNS. The HTTP Via header is used to track proxy chains, aiding debugging. Early web proxies like CERN httpd (1990s) pioneered caching. The Proxy-Authorization header enables client authentication to proxies. Some proxies support ICAP (Internet Content Adaptation Protocol) for external content processing, such as virus scanning⁵.

Forward proxy

A proxy that forwards requests from clients to the internet, acting on behalf of the client.

Reverse proxy

A proxy that receives requests from the internet and forwards them to internal servers, appearing as the server to clients.

Transparent proxy

A proxy that intercepts network traffic without requiring client configuration, often used for content filtering.

CONNECT method

An HTTP method used to establish a tunnel (typically for HTTPS) through a proxy server.

PAC file

Proxy Auto-Configuration file, a JavaScript file that tells a browser which proxy to use for different URLs.