How exactly does a proxy work?

Question

If I want to connect to say, IP 100.100.100.100, Port 80, my computer will send a tcp packet with this adress into the wire.

Now If I use a proxy server say, 200.200.200.200 Port 8080 (such kind of proxy that you can set up in internet explorer) how is this process changed?

When I still want to connect to the same IP, will the IP header will include the destination IP or the proxy IP or both?

I already googled, there are hundreds of pages that tell you how to set up a proxy but none explains how it works under the hood.

Solution 1

The HTTP request is sent from Client to port 8080 of the Proxy Server. The Proxy Server then originates a new HTTP request to the destination site. The proxy, depending on the configuration, will often add a "X-Forwarded-For" header to the HTTP request. The log files on the destination web site will show the proxy's IP address, but may or may not be configured to log the "X-Forwarded-For" address.

That's the typical configuration, but proxy software will allow you all kinds of customization.

EDIT: I should note that when I originally read your question, I got the idea you were asking about an HTTP Proxy specifically, such as squid or nginx. There are many different types of proxies available. In Internet Explorer, you'll most likely be using an HTTP proxy, but there are many other types as well.

Solution 2

HTTP is a Layer 7 protocol so dont get confuse. when you use a HTTP proxy and you type say google.com , the HTTP header still same google.com, but the destination IP address will be IP address of the Proxy, source will be Hosts IP to the customized port number 8080.

Solution 3

To use an HTTP proxy, the request is sent from the client to the proxy server's IP address rather than to the destination server. The proxy must then read the HTTP header to extract the request-URI. The request-URI includes the name or IP of the destination server, and the proxy server uses that information to forward the request.

The HTTP specification allows the request line to exclude the server name and port when a proxy is not used (since these would be unnecessary if the request was sent directly to that server). But, as per the spec...

The absoluteURI form is REQUIRED when the request is being made to a proxy.

So when not using a proxy, the request line might look like:

GET /robots.txt HTTP/1.1

but to use a proxy, the line must include the server name (and port if not 80):

GET http://httpbin.org:80/robots.txt HTTP/1.1

---

The response side if the operation can be simpler since the proxy server may simply relay the verbatim response via the pre-established request socket.

Comments

[entropo]

Yeah, it very much depends on the software you're using as a proxy server and how it is configured. See, e.g., the HttpProxyModule for Nginx: wiki.nginx.org/HttpProxyModule

[cody]

If the request in sent to the proxy server only, how does the proxy know which destination address I want connect to? Does the proxy work at http level or at tcp level?

[emgee]

The browser making the request to the proxy requests the full URI. The proxy server then does the DNS lookup and originates it's own HTTP request to the target site.

[cody]

Does this mean the proxy does not work at tcp level but instead at http level?

[emgee]

A http proxy, like Squid (which I've been basing my answer on) works at the application layer.

[vtest]

@emgee: HTTP protocol also has a CONNECT method, so it is possible to connect through a HTTP proxy to a TCP server (if the proxy allows it) and that TCP server doesn't have to be a server that speaks HTTP.

[LawrenceC]

Proxies are protocol specific. So there are TCP proxies, HTTP proxies, SOCKS proxies, FTP proxies, etc.

[Brent Bradburn]

From "HTTP The Definitive Guide", pg. 145: "HTTP/1.1 now requires servers to handle full URIs for both proxy and server requests, but in practice, many deployed servers still accept only partial URIs."

[Brent Bradburn]

It isn't the standard approach, but a proxy might also be able to use the Host header to complete a partial URI if an absolute URI is not provided in the request line.

[Brent Bradburn]

This approach can't work if the connection is end-to-end encrypted (HTTPS). security.stackexchange.com/questions/101721/…