Repository navigation
feat: bypass the proxy for the hosts listed in nonProxyHosts - #1577
Merged
Merged
Conversation
Collaborator
Author
|
Full module |
jlouvel
force-pushed
the
fix/netty-non-proxy-hosts
branch
from
October 31, 2026 07:44
a3b9e8d to
599b447
Compare
jlouvel
force-pushed
the
fix/netty-non-proxy-hosts
branch
from
November 1, 2026 14:56
599b447 to
fac8722
Compare
jlouvel
force-pushed
the
fix/netty-non-proxy-hosts
branch
from
November 1, 2026 16:18
fac8722 to
2bd2e6f
Compare
jlouvel
force-pushed
the
fix/netty-non-proxy-hosts
branch
from
November 1, 2026 20:16
0cfaa9b to
d625c38
Compare
When a proxy was configured, the Netty client sent every request through it, including requests to localhost and internal hosts. - NettyClientHelper: new "nonProxyHosts" parameter, defaulting to the "http.nonProxyHosts" system property, with the JDK syntax: host names separated by "|", with an optional leading or trailing "*" wildcard, matched ignoring case. It applies to HTTP and HTTPS requests. Unlike the JDK, no host is excluded by default. - ProxyTestCase: parameter and system property bypass, other hosts still proxied. Closes #401. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Jerome Louvel <374450+jlouvel@users.noreply.github.com>
As with the JDK, nonProxyHosts defaults to localhost|127.*|[::1]|0.0.0.0|[::0] when neither the parameter nor the http.nonProxyHosts system property is set. An empty value excludes no host. Refs #401 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
In the HTTP2 transport mode, the Netty client sent the HTTP/2 connection preface (prior knowledge) to the forward proxy for http:// requests. HTTP proxies generally only speak HTTP/1.1 to clients, so these requests failed. - NettyClientHelper: cleartext connections to a forward proxy use HTTP/1.1 with absolute-form request targets, logged at FINE level. HTTPS requests through CONNECT tunnels still negotiate HTTP/2 with ALPN. - ProxyTestCase: HTTP2 mode request through the forward proxy. Closes #1571. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Jerome Louvel <374450+jlouvel@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jlouvel
force-pushed
the
fix/netty-non-proxy-hosts
branch
from
November 1, 2026 21:24
d625c38 to
8baeea1
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #401. Based on #1575.
When a proxy was configured, the Netty client sent every request through it, including requests to
localhostand internal hosts.Changes
NettyClientHelper:nonProxyHostsconnector parameter, falling back to thehttp.nonProxyHostssystem property. It uses the JDK syntax: host names separated by|, each with an optional leading or trailing*wildcard, matched ignoring case. As in the JDK, the list applies to both HTTP and HTTPS requests.getNonProxyHosts().getProxy(secure, targetHost)now returns null for matching hosts, so these requests use origin-form request lines, connect directly, and are not tunneled.NettyClientCall: the tunnel check passes the target host.ProxyTestCase: loopback hosts bypassed by default, bypass with the parameter (with spaces and mixed case) and with the system property over HTTPS, and other hosts still proxied, including a check thatlocaldoesn't matchlocalhost.changes.md: entry under Enhancements.Loopback default
As with the JDK, when neither the parameter nor
http.nonProxyHostsis set, the loopback addresses are excluded by default:localhost|127.*|[::1]|0.0.0.0|[::0]. An empty value excludes no host, as in the JDK. This is a small behavior change: a client with a proxy configured now connects directly tolocalhost. The proxy tests setnonProxyHoststo an empty string so they can still use a test proxy on localhost.Validation
ProxyTestCase: 11 tests pass.🤖 Generated with Claude Code