f302e15228
Per @unterwegi's feedback in #2446, environment variable handling conflicts with cpp-httplib's long-standing policy of explicit configuration (e.g. set_ca_cert_path requires explicit paths instead of reading SSL_CERT_FILE / SSL_CERT_DIR). The NO_PROXY matching logic is the genuinely tricky part worth keeping in the library; getenv parsing is trivial and is left to the caller. - Remove Client::set_proxy_from_env, ClientImpl::set_proxy_from_env, and ClientImpl::apply_proxy_url - Remove ScopedEnv test helper and env-driven NoProxyTest cases - Replace the "Read proxy settings from the environment" docs with a short snippet showing how to parse no_proxy and feed set_no_proxy() - Keep set_no_proxy() and all NO_PROXY pattern matching intact
3.5 KiB
title, order, status
| title | order | status |
|---|---|---|
| C16. Send Requests Through a Proxy | 16 | draft |
To route traffic through a corporate network or a specific path, send requests via an HTTP proxy. Just pass the proxy host and port to set_proxy().
Basic usage
httplib::Client cli("https://api.example.com");
cli.set_proxy("proxy.internal", 8080);
auto res = cli.Get("/users");
The request goes through the proxy. For HTTPS, the client uses the CONNECT method to tunnel through — no extra setup required.
Proxy authentication
If the proxy itself requires authentication, use set_proxy_basic_auth() or set_proxy_bearer_token_auth().
cli.set_proxy("proxy.internal", 8080);
cli.set_proxy_basic_auth("user", "password");
cli.set_proxy_bearer_token_auth("token");
If cpp-httplib is built with OpenSSL (or another TLS backend), you can also use Digest authentication for the proxy.
cli.set_proxy_digest_auth("user", "password");
Combine with end-server authentication
Proxy authentication is separate from authenticating to the end server (C05. Use Basic authentication, C06. Call an API with a Bearer token). When both are needed, set both.
cli.set_proxy("proxy.internal", 8080);
cli.set_proxy_basic_auth("proxy-user", "proxy-pass");
cli.set_bearer_token_auth("api-token"); // for the end server
Proxy-Authorization is sent to the proxy, Authorization to the end server.
Bypass the proxy for specific hosts
You often want internal endpoints to skip the proxy. Configure a bypass list with set_no_proxy().
cli.set_proxy("proxy.internal", 8080);
cli.set_no_proxy({"internal.corp", "10.0.0.0/8", "*.dev.local"});
Each entry is one of:
*— bypass the proxy for all hosts- a hostname suffix (e.g.
example.com) — matchesexample.comitself and any subdomain (foo.example.com). A leading dot is permitted but informational; both forms are equivalent. - a single IP literal (e.g.
192.168.1.1,::1) - a CIDR block (e.g.
10.0.0.0/8,fe80::/10)
Hostname matching is case-insensitive and uses a dot-boundary rule, so an entry of example.com does not match evilexample.com. IP comparisons are normalized through inet_pton, so 127.0.0.1 cannot be bypassed via alternate string forms (e.g. 127.000.000.001). When an entry matches, the Proxy-Authorization header is suppressed as well.
Malformed entries are silently dropped. Port-specific entries such as example.com:8080 are not supported (cpp-httplib's other host-keyed APIs are also keyed on hostname only).
Reading proxy settings from the environment
cpp-httplib does not read HTTP_PROXY / HTTPS_PROXY / NO_PROXY itself. The library's configuration API is explicit by design — set_ca_cert_path() is the same way. If you want that behavior, parse the variables in your application and feed them to set_proxy() and set_no_proxy().
if (auto *v = std::getenv("no_proxy"); v && *v) {
std::vector<std::string> patterns;
std::stringstream ss(v);
for (std::string item; std::getline(ss, item, ',');) {
if (!item.empty()) { patterns.push_back(std::move(item)); }
}
cli.set_no_proxy(patterns);
}
Security Note: If you also read
HTTP_PROXYfrom the environment, prefer the lowercasehttp_proxyonly. The uppercase form is poisoned in CGI/FastCGI environments by theProxy:request header (CVE-2016-5385 / "httpoxy").HTTPS_PROXYandNO_PROXYare safe in either case because their names do not begin withHTTP_.