Send requests through a proxy

A proxy is a server that forwards your requests for you. Instead of connecting to the destination, curl connects to the proxy and asks it to reach the destination on its behalf. You meet proxies in corporate networks, in debugging tools like mitmproxy that run on your own machine, and in scrapers that route traffic through specific egress addresses.

The essential thing to understand: a proxy becomes an intermediary in the connection path. That has protocol consequences and trust consequences.

Point curl at a proxy

Point a lab request at a local proxy:

curl --proxy http://127.0.0.1:8080 --verbose https://example.org/ -o /dev/null

For HTTPS through an HTTP proxy, curl normally uses CONNECT before negotiating TLS with the destination. You can watch it happen in the verbose output:

* Connected to 127.0.0.1 port 8080
> CONNECT example.org:443 HTTP/1.1
< HTTP/1.1 200 Connection established
* SSL connection using TLSv1.3

Read that sequence carefully, because it separates the two relationships. First, a plain connection to the proxy. Then CONNECT, which asks the proxy to open a raw tunnel to example.org:443. The proxy answers 200 Connection established, and only then does curl negotiate TLS — with the destination, through the tunnel. The proxy shuttles encrypted bytes it cannot read.

Inspect both proxy logs and curl verbose output when testing. Separate the connection to the proxy from the protected connection to the target: a failure before CONNECT is a proxy problem, a failure after is between you and the destination.

SOCKS proxies

For a SOCKS proxy, such as the one ssh -D 1080 gives you, change the scheme:

curl --proxy socks5h://127.0.0.1:1080 https://example.org/

The h in socks5h matters: it makes the proxy resolve the hostname, so no DNS query leaks from your machine. Plain socks5 resolves locally first.

curl also honors environment variables like https_proxy, which is worth remembering when curl uses a proxy you never asked for. --noproxy '*' disables that for one command.

The trust boundary

A proxy can observe destinations and, without end-to-end TLS, content. Even with TLS it sees every hostname you visit and when. If the proxy asks you to install its own CA certificate to inspect HTTPS, it can read everything. Use only a proxy you trust and understand — you are adding a party to every conversation.