CONNECT establishes a TCP tunnel through an HTTP proxy to a target host and port. Browsers use CONNECT to set up HTTPS connections through a forward proxy – the proxy connects to the target server and then acts as a transparent tunnel. The client and server communicate directly through the tunnel using TLS. CONNECT is the mechanism behind HTTP proxy support for HTTPS.
Properties
| Safe | No | Safe methods don't change server state. They are read-only. |
| Idempotent | No | Idempotent methods produce the same result if called once or multiple times. |
| Cacheable | No | Cacheable responses may be stored and reused for equivalent requests. |
| Request Body | No | Whether a request body is allowed / expected. |
| Response Body | No | Whether a response body is expected. |
Description
CONNECT turns an HTTP proxy into a TCP tunnel. The client sends CONNECT host:port to the proxy. If allowed, the proxy establishes a TCP connection to the target and responds with 200 Connection Established. The client then starts a TLS handshake directly with the target through the tunnel – the proxy sees only encrypted bytes. This is how tools like curl, git, and browsers work with HTTPS_PROXY.
Examples
CONNECT api.example.com:443 HTTP/1.1
Host: api.example.com:443 Proxy-Authorization: Basic dXNlcjpwYXNzHTTP/1.1 200 Connection Established
Proxy-agent: Squid/4.17
# TLS handshake begins here →# curl uses CONNECT automatically for HTTPS through a proxy
curl -x http://proxy.corp:8080 https://api.example.com/data