Glossary · Networking

HTTP CONNECT

HTTP CONNECT is the HTTP request method a client sends to a proxy to ask for a tunnel to a host and port; once the proxy answers with a 2xx status it blindly forwards bytes in both directions, which is how HTTPS passes through an HTTP proxy with TLS intact end to end (RFC 9110, section 9.3.6).

Reviewed 30 Oct 2026

Watch the CONNECT exchange2 lines

# -v prints the CONNECT request curl sends to the proxy and the 2xx that opens the tunnelcurl -v -x "http://USERNAME_pool-arcfast_country-de:PASSWORD@proxy.arcproxies.io:8000" https://example.com/ -o /dev/null

What the exchange looks like

The client sends CONNECT example.com:443 HTTP/1.1 with a Host header and, for an authenticated proxy, Proxy-Authorization. The request target is only host and port, and the port is mandatory — there is no default.

Any 2xx response means the tunnel is open and everything after the response headers comes from the destination. The client then starts its TLS handshake with the site through the tunnel. Any other status means no tunnel was formed.

What the proxy can and cannot see

Sees: the destination host and port, connection timing, and the number of bytes in each direction.
Does not see: the URL path, query string, headers, cookies or page content — all inside TLS.
Consequence: a proxy cannot compress or cache HTTPS for you, and any per-request option has to travel in the credentials. On a backconnect gateway that is why location and session are username tokens.

Common errors

Symptom	Usual cause
407 Proxy Authentication Required	Missing or wrong credentials, or special characters not URL-encoded in the proxy URL
400 Bad Request	No port, or an invalid one, in the CONNECT target
TLS error after a 2xx	Client verifying the certificate against the proxy instead of the site; check the scheme

The proxy URL starts with http:// even for HTTPS sites: that scheme describes how you talk to the proxy, not to the destination. SOCKS5 is the other way to tunnel; client-specific setup is in the curl and Go guides.

FAQ

Questions

Something not covered? Write to contact@arcproxies.io.

Why does my proxy URL start with http:// when the site uses HTTPS?

The scheme in the proxy URL is the protocol spoken to the proxy. The client talks plain HTTP to the proxy only long enough to send CONNECT, then runs TLS with the destination through the tunnel.

Can a proxy read HTTPS traffic sent through CONNECT?

Not without breaking TLS. The proxy relays encrypted bytes and sees only the destination host, port and volume. A proxy that wants to read the content has to terminate TLS itself, and the client would see a certificate that is not the site's.

What does 407 Proxy Authentication Required mean?

The proxy wants credentials it did not get or did not accept. Check the username and password, and URL-encode any special characters when they are embedded in the proxy URL.

Is HTTP CONNECT the same as SOCKS5?

Both create a tunnel, but CONNECT is an HTTP method sent to an HTTP proxy, while SOCKS5 is its own binary protocol. CONNECT is used for TCP; SOCKS5 also defines UDP relaying.

Sources & review

Last reviewed 30 October 2026 by the ARC Proxies team. Prices are read from the live catalog at build time.

[1]IETF: RFC 9110: HTTP Semantics

In practice

Where http connect matters

IntegrationcurlSend curl through an authenticated proxy with -x and -U, check the exit IP, test sticky sessions and countries, use socks5h, and read 407 failures.IntegrationNode.js fetchNode's built-in fetch has no proxy option. Use undici's ProxyAgent as the dispatcher, or NODE_USE_ENV_PROXY, with sticky sessions, SOCKS5 and 407 handling.IntegrationGoRoute Go's net/http through an authenticated proxy: Transport.Proxy with url.UserPassword, a sticky session per request context, SOCKS5 and 407 checks.ProductResidentialReal consumer IPs in 185+ countries with city targeting, rotating or sticky, billed per gigabyte with no subscription and no expiry.