BoltConn
BoltConn copied to clipboard
HTTP2 support + HTTPS Proxy
When using BoltConn without root, the proxy can only be accessed without encryption.
It would be great to allow support for HTTPS:
me@host~> curl -4IL --proxy http://127.0.0.1:9961 https://example.com
HTTP/1.1 200 OK
HTTP/2 200
me@host~> curl -4IL --proxy https://127.0.0.1:9961 --cacert ~/.local/share/boltconn/cert/crt.pem https://example.com
curl: (35) TLS connect error: error:0A0000C6:SSL routines::packet length too long
Also, would HTTP2 support be hard to implement?
I have updated the support for http2, so it should work now. Let me know if anything goes wrong.
As for local https proxy, here are the reasons I don't want to support it:
- There is no standardized "https proxy". No RFC or any specs, so it could be difficult to have a good implementation.
- There are few applications actually support http proxy with an additional tls layer under it. And because of 1), there will be foreseeable many issues and difficult to fix without actually using them.
- If you already connect to the destination server with https, the http proxy will directly forward the TLS traffic without looking into the inner contents (with CONNECT method to upgrade the connection). So if you think https traffic on public network is already safe enough for your threat model, you can just use a normal http proxy.