2 ms·
With CONNECT-UDP you also get UDP, just like this, and over HTTPS it's not going to be filterable, right?
by shawnz 3y ago
With CONNECT-UDP you also get UDP, just like this, and over HTTPS it's not going to be filterable, right?
- lxgr 3y agoYeah, I suspect it's pretty similar using HTTP/2 when considering all of these new proxy modes; I've been wondering as well if there are any other differences or if it just predates the specification of that (and UDP over HTTP). With HTTP/1, I don't think there is a way to multiplex multiple TCP or UDP bindings over a single connection – maybe this supports it? The diagram seems to suggest it, and e.g. SSH does too (and is equivalent to CONNECT proxying over HTTP/2 in that sense).
- kbolino 3y agoLarge enterprise firewalls generally do not allow true end-to-end HTTPS. The firewall masquerades as the destination sites using custom certificates, issued on-the-fly under a custom root CA controlled by the firewall, which is pre-installed on every device approved for use in the enterprise. Certain sites (e.g. banks) and certain users (e.g. C-suite) may be exempt from this by policy, but the default policy is to MITM all connections.