1

I am looking to programmatically send scrape requests containing confidential information through a 3rd party forward rotating proxy service like SmartProxy to an HTTPS API. Will the proxy be able to decrypt my request and read any of the information?

Thanks, Mike

2 Answers 2

0

Will the proxy be able to decrypt my request and read any of the information?

Normally, no.

When you use a normal forward proxy and attempt to connect to a https site, your browser issues a CONNECT-command, containing a hostname and port number. Thus, the proxy will learn the hostname and port you're connecting to. However, the TCP stream that is proxied will be encrypted:

For example, the CONNECT method can be used to access websites that use SSL (HTTPS). The client asks an HTTP Proxy server to tunnel the TCP connection to the desired destination. The server then proceeds to make the connection on behalf of the client. Once the connection has been established by the server, the Proxy server continues to proxy the TCP stream to and from the client.

Thus the proxy will not learn the content, as it is encrypted. It may be able to infer things about the content, as it knows the hostname and size of the traffic. But it will not see the cleartext traffic.

Note that this answer is not true for TLS bumping proxies used in e.g. corporate environments.

-1

It depends on if the proxy works on the HTTP level or the TCP level.

If it is an HTTP proxy, then in order for the HTTP request to be read, it has to be decoded by the proxy. In other words, they would be able to read the traffic, but the traffic to and from would be encrypted.

If it is a TCP proxy, then the SSL is handled between the client and your server and so the proxy would not be able to decode the traffic without the private certificate.

From the look of it, it appears that they potentially could look at the traffic:

"Currently, we support only HTTP/S protocols. This communication protocol is encrypted using a proprietary algorithm."

From: https://smartproxy.com/faq/general#what-protocols-are-supported

It looks like the use cause for this proxy doesn't really match up with "needing to send sensitive data" - it looks like this is more for scrapping site s and social media that will block requests from the same IP repeatedly hitting the site.

2
  • 1
    HTTPS is proxied using a CONNECT command.
    – vidarlo
    Apr 20, 2023 at 9:44
  • I agree aslong as you do not splice the connection it only shows that it goes to xyz
    – djdomi
    Apr 22, 2023 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .