HTTP proxies: A tiny mistake in tinyproxy

2 mins read 2026-06-28

This article is the part two of two articles in the "HTTP proxies" series. Check part one for complete context.

Proxied thoughts

After realizing the missing CONNECT request on both building options (with and without OpenSSL), I still have one unanswered question in my head: Why did the connection worked for ifconfig.io?

I booted up a container with tinyproxy, busybox wget and tcpdump. tinyproxy is listening on local port 8888 and I configured the proxy environment variables like:

export http_proxy=http://localhost:8888
export https_proxy=http://localhost:8888

Made the following request while capturing network packages:

$ busybox wget -O- https://ifconfig.io
Connecting to localhost:8888 ([::1]:8888)
writing to stdout
<MY IP>
-                    100% |**********************|    12  0:00:00 ETA
written to stdout

We can see that the request was actually made to the port 80 of the destination server. Although the URL has https as the protocol, both the client (busybox wget) and the proxy (tinyproxy) ignored it and established an HTTP connection to the remote server.

Next, I repeated the experiment by downloading a tarball from busybox.net:

$ busybox wget -O /tmp/busybox-1.36.1.tar.bz2 https://busybox.net/downloads/busybox-1.36.1.tar.bz2
Connecting to localhost:8888 ([::1]:8888)
wget: too many redirections

Like in the previous experiment we can see that the request was made to the port 80 of the destination server and the server replied with a 301. The rest we already know.

Both ifconfig.io and busybox.net listen on ports 80 and 443. While busybox server simply redirects all HTTP to HTTPS requests by sending 301 responses, ifconfig server actually replies with the requested resource on port 80. Mistery solved!

Conclusion

What started as a weird network issue, escalated to a possible server's misconfiguration turned out to be an client-side application bug on busybox wget. Clients should always use CONNECT for HTTPS destinations and proxies should reject malformed requests rather than ignoring the requested protocol in favor of HTTP. I also opened a merge request in tinyproxy's repository with a patch that rejects malformed client requests.