Skip to content

feat: support forward and reverse HTTP/HTTPS proxy with basic authentication - #49

Merged
esrrhs merged 1 commit into
masterfrom
feat/http-and-reverse-http-proxy
Sep 24, 2026
Merged

esrrhs merged 1 commit into
masterfrom
feat/http-and-reverse-http-proxy

Conversation

@esrrhs

@esrrhs esrrhs commented Sep 24, 2026

Copy link
Copy Markdown
Owner

Summary

This PR implements full support for forward and reverse HTTP/HTTPS proxies in SPP, complete with optional username/password Basic authentication.

Key Features & Implementation

  1. HTTP/HTTPS CONNECT Tunneling:
    • Supports the HTTP CONNECT method for HTTPS and arbitrary TCP streams.
    • Responds with HTTP/1.1 200 Connection Established upon handshake.
  2. Standard HTTP Request Proxying:
    • Transparently parses and proxies standard HTTP methods (GET, POST, PUT, DELETE, etc.).
    • Converts absolute URIs to origin-form relative paths.
    • Strips Proxy-Authorization and Proxy-Connection headers before sending to target servers to prevent credential leakage.
  3. Optional Basic Authentication:
    • Matches SOCKS5 authentication behavior: if -username and -password are configured, proxy requests require valid Proxy-Authorization: Basic <base64> credentials.
    • Unauthenticated requests receive HTTP/1.1 407 Proxy Authentication Required.
    • If no username/password is configured, authentication is disabled.
  4. Forward and Reverse Proxy Modes:
    • Forward HTTP proxy (-type http_client): client listens locally on fromaddr and proxies out via the remote server.
    • Reverse HTTP proxy (-type reverse_http_client): server listens on fromaddr and proxies requests into the client network.
  5. Config Generator & Documentation:
    • -genconfig now generates config_http_client.json and config_reverse_http_client.json.
    • Updated README.md and USAGE.md with quick start commands and schemas.

Testing

  • Added unit and end-to-end test cases in proxy/http_test.go:
    • TestHttp_AuthCheck: unit verification for Basic authentication logic.
    • TestE2E_HTTPProxy_Forward: verifies 407 challenge, CONNECT tunneling, and HTTP GET request forwarding.
    • TestE2E_HTTPProxy_Reverse: verifies reverse HTTP proxying and auth handling.
    • TestE2E_HTTPProxy_NoAuth: verifies unauthenticated forward proxying.
  • All packages and existing E2E tests pass (go test ./...).

…ication

- Add HTTP and REVERSE_HTTP client types in proxy.proto and regenerate pb
- Implement NewHttpInputer supporting CONNECT tunneling and plain HTTP requests
- Support optional Basic proxy authentication with 407 response code
- Strip Proxy-Authorization and Proxy-Connection headers to prevent credential leakage
- Wire forward HTTP and reverse HTTP proxy into client.go and server.go
- Support http_client and reverse_http_client in CLI and config generator
- Add comprehensive unit and end-to-end tests for HTTP and reverse HTTP proxy
- Update README.md and USAGE.md documentation
@esrrhs
esrrhs merged commit 50825d7 into master Sep 24, 2026
8 checks passed
@esrrhs
esrrhs deleted the feat/http-and-reverse-http-proxy branch September 24, 2026 15:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant