connect
HTTP CONNECT
Requests that an HTTP proxy establish a TCP tunnel to the origin server identified by the request-target, typically for HTTPS traffic. After a 2xx response, the connection is no longer HTTP - it becomes an opaque byte pipe.
CONNECT host:port HTTP/1.1Properties
| Property | Value / Meaning |
|---|---|
| Safe | No - it opens a network tunnel; the effect is not resource retrieval. |
| Idempotent | No - each CONNECT creates a distinct TCP tunnel. |
| Cacheable | No - responses must never be cached. |
| Has body | No before 2xx - after a 2xx the connection carries arbitrary bytes, not an HTTP body. |
| Body in response | No structured body - after 2xx the socket is a raw tunnel for the client's TLS or protocol data. |
Examples
curl -x http://proxy.example.com:8080 https://api.example.com/curl issues CONNECT api.example.com:443 to the proxy under the hood.
CONNECT api.example.com:443 HTTP/1.1\nHost: api.example.com:443Raw request line and Host asking the proxy to tunnel to port 443.
curl -x http://proxy:8080 -U user:pass https://example.com/CONNECT with Proxy-Authorization: Basic credentials.
openssl s_client -proxy proxy.example.com:8080 -connect example.com:443TLS handshake tunneled through a CONNECT proxy.
Gotcha
The request-target must be authority-form (host:port), not a path or URL. Proxies typically allow CONNECT only to port 443 - locking down other ports prevents SMTP/SSH tunneling and abuse.
Related methods
HTTP OPTIONS
Asks the server which communication options (methods, headers, CORS rules) are available for the target resource. Widely used by browsers as the CORS preflight before non-simple cross-origin requests.
HTTP TRACE
Performs a message loop-back test along the path to the target resource, so the client can see exactly what proxies received. The final recipient echoes the request back as the message body of a 200 response.
HTTP GET
Requests a representation of the specified resource. It is the most common HTTP method and should have no side effects on the server.