22.01.2010 18:15, D. Richard Hipp wrote:
In my office all communication goes through same http proxy,
including https. I guess they do pass-thru somehow.
Think about it. With HTTPS, only the two endpoints are able to read
the content of the transmission. How can the proxy get involved? If
the proxy could come into play, that would mean that HTTPS was
vulnerable to a man-in-the-middle attack - it would be a serious
weakness of HTTPS.
It uses HTTP CONNECT method of http-proxy. It is secure, similar to SSH
tunnels.
http://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_Tunnelling
"A variation of HTTP tunnelling when behind an HTTP Proxy Server is to
use the "CONNECT" HTTP method [1].
In this mechanism, the client asks an HTTP Proxy server to forward the
TCP connection to the desired destination using the "CONNECT" HTTP
method. The server then proceeds to make the connection on behalf of the
client. Once the connection has been established by the server, the
Proxy server continues to proxy the TCP stream to and from the client.
Note that only the initial connection request is HTTP - after that, the
*server simply proxies the established TCP connection*.
This mechanism is how a client behind an HTTP proxy can access websites
using SSL (i.e. HTTPS)."
_______________________________________________
fossil-users mailing list
[email protected]
http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
