Finish Parsing CONNECT Headers Before Relaying the Client Stream

A proxy server that relays after only the request line can send its own Host header to the destination's TLS port.

After the CONNECT request line, these bytes still belong to the proxy:

CONNECT service.example:443 HTTP/1.1\r\n
Host: service.example:443\r\n
User-Agent: example-client\r\n
\r\n

Forwarding Host or User-Agent to port 443 gives the destination plaintext headers where it expects TLS. That failure can occur before any cipher choice matters.

  1. Read and parse through the blank-line header terminator, under a setup deadline and header-size limit.
  2. Apply the proxy authentication and destination policy.
  3. Establish the approved target connection.
  4. Send the successful CONNECT reply and enter tunnel mode.

Preserve buffered bytes after the boundary for the appropriate next state. Do not discard them or treat the proxy's request headers as the website's later request.

The client has a matching response-side obligation: finish reading the successful CONNECT reply before starting the tunneled protocol. Both ends must agree on the boundary where the stream changes roles.

ХӀокхунах тера йаззамаш