Consider a firewalled network with the high-level requirement that normal web browsing should work, but nothing else (e.g. ssh and Skype are forbidden). All traffic is blocked, except for outgoing HTTP(S) traffic which goes via a mandatory proxy.
What should the proxy do with HTTP CONNECT traffic? At one extreme, it could allow everything through, which would make the firewall ineffective. At the other extreme, it could be blocked: would this completely block HTTPS (I've noticed that wget uses CONNECT to tunnel https through
$https_proxy: is this the universal method?)? (Assume the proxy is not going to play man-in-the-middle hoping that clients wouldn't notice the fake certificates.)
In other words, what is the practical “normal” use of CONNECT (with a proxy in the mix), and what is a good approximation of restricting its use to the “normal” cases?
(This is what I meant to ask when I asked my previous question.)