Does a web request with proxy always require a new connection?

user_3748325 0
Viewed 483

This is a question around how a proxy should behave with HTTPS requests. If there are 2 users behind a proxy and both go to https://example.com one after another, can the proxy reuse the existing TCP connection created with example.com earlier for user1.

Both TCP and HTTPS are different protocols, so it doesn't seem like it should affect anything, and in practice it doesn't as well.

Is there something in existing TLS implementations that might not like this kind of behavior of having two different sessions over the same connection? Would this be a bad idea from a security perspective to have the same TCP connection for different users?

https proxy ssl
2 Answers

You mean if two HTTP clients make requests to a reverse HTTP proxy, could the proxy reuse TCP connections to the HTTP server?

scenario

Yes, absolutely. This is called connection pooling and it is common in practice. The proxy opens a pool of persistent connections with each backend endpoint. Then, the proxy queues requests and each request gets sent on an available TCP connection.

From a TLS perspective, if the proxy is an HTTP proxy (L7), clients perform TLS handshakes with the proxy, not the backend web servers and, hence, there's no problem. However, if the proxy operates at L4, TLS termination must occur downstream (TLS pass-through), which poses complication.

My current understanding is that L4 proxies maintain 1:1 connections with backends. Meaning, each incoming connection has a corresponding outgoing connection to a backend, which removes our ability to reuse connections and leverage connection pooling.

For example, NGINX does this:

nginx NGINX maintains a “cache” of keepalive connections – a set of idle keepalive connections to the upstream servers – and when it needs to forward a request to an upstream, it uses an already established keepalive connection from the cache rather than creating a new TCP connection.

Load Balancing with NGINX and NGINX Plus, Part 2

Helpful resources

user_41356700

I don't think it will be possible with https.

Proxying https with http proxy requires client to use http CONNECT method which provides raw TCP connection and reusing upstream connections has a consequence that every subsequent client would have to receive connection with a history. That probably wouldn't be a problem in case of web traffic but will violate other connection aware protocols (such as SSH or SMTP) that for example expect invitation banner. Because proxy is unaware of higher layer protocol that is going to be used therefore it can't assume reusing TCP connection would work.

For proxying plain HTTP traffic (which does not utilize http CONNECT method) that should not be an issue as long as client does not send http request with a header:

Connection: close

so while it's a common solution in well controlled environments with a reverse proxy I have no idea if any forward proxy is capable of reusing TCP connection to upstream servers that are not limited to some server pool defined in a proxy configuration.

user_41543590
Related