Repository navigation
Conversation
Collaborator
Author
|
Full module |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
A critical credential leak remains: HTTPS requests made with only http.proxyHost configured can send the generated Proxy-Authorization header directly to the origin.
1 open issue
What changed in this PR
Updates the Netty client to select proxy system properties by request scheme, addressing #1570 while preserving shared connector parameters and the CONNECT handling introduced in #1574.
Changes:
- Uses
https.proxyHostandhttps.proxyPortfor HTTPS proxy selection. - Adds tests for HTTPS proxy properties and ignoring HTTP-only proxy settings.
- Updates proxy documentation and the changes log.
| File | Description |
|---|---|
org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java |
Adds scheme-specific proxy tests with system-property restoration. |
org.restlet/src/main/java/org/restlet/engine/netty/NettyClientHelper.java |
Adds HTTPS proxy accessors and scheme-aware proxy selection. |
org.restlet/src/main/java/org/restlet/engine/netty/NettyClientCall.java |
Uses HTTPS proxy selection for tunnel detection. |
changes.md |
Records the HTTPS proxy-property fix. |
Review effort: Balanced
The Netty client fell back to the http.proxyHost and http.proxyPort system properties for HTTPS requests too. Like the JDK, it now uses https.proxyHost and https.proxyPort for them. The proxyHost and proxyPort connector parameters still apply to both schemes. - NettyClientHelper: new getHttpsProxyHost() and getHttpsProxyPort(), and a package-private getProxy(secure) used to route each request. - ProxyTestCase: HTTPS requests use the https.* properties and ignore the http.* ones. Closes #1570. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Jerome Louvel <374450+jlouvel@users.noreply.github.com>
With only the http.proxyHost system property set, HTTPS requests connect directly to the origin server, and the Proxy-Authorization header of their proxy credentials was sent to it. - NettyClientCall: remove the Proxy-Authorization header of the requests that neither go through a CONNECT tunnel nor to a forward proxy. - ProxyTestCase: the origin server doesn't receive the proxy credentials of an HTTPS request when only the http.* proxy properties are set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jlouvel
force-pushed
the
fix/netty-https-proxy-properties
branch
from
October 30, 2026 20:12
c4fc133 to
970add5
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1570. Based on #1574.
For HTTPS requests, the Netty client fell back to the
http.proxyHost/http.proxyPortsystem properties. The JDK convention (Networking Properties) ishttps.proxyHost/https.proxyPortfor HTTPS. So a JVM configured with only thehttps.*properties sent HTTPS requests directly, and one with only thehttp.*properties tunneled HTTPS requests through a proxy meant for plain HTTP.Changes
NettyClientHelper:getHttpsProxyHost()/getHttpsProxyPort(): theproxyHost/proxyPortparameters, else thehttps.*system properties, with port 3128 by default as before.getProxy(boolean secure)now picks the proxy of each request.create(),acquire()(the HTTP/3 bypass) andconnect()use it.NettyClientCall: the tunnel check usesgetProxy(true).ProxyTestCase: HTTPS requests go through thehttps.*proxy and ignore thehttp.*one. The tests restore the system properties when done.changes.md: entry under Bugs fixed.The
proxyHost/proxyPortconnector parameters still apply to both schemes, andgetProxyHost()/getProxyPort()are unchanged. I didn't add separatehttpsProxyHost/httpsProxyPortparameters: a client needing different proxies per scheme can use the system properties, and I'd rather not grow the parameter list without a use case.Validation
ProxyTestCase: 7 tests pass. The full moduleverifywas run at the top of the stack (see #1574 for the first one).🤖 Generated with Claude Code