Do HTTP proxy servers modify request packets?

Question

Is any request header added or modified to the HTTP request before forwarding to the server by a proxy server?

If so, are the changes done to the same packets, or are the contents used to create new request packets with the modifications?

Tucker

Answer 1

There are a few different types of proxy servers. Because you've mentioned request headers, I'm going to assume that you're talking about HTTP proxy servers, which forward HTTP requests, not packets.

NOTE: In the special case of HTTPS requests (TLS/SSL via CONNECT), proxy servers will just forward the content of the TCP packets (and are unable to inspect the packets unless acting as a man-in-the-middle proxy).

---

Of course it depends on the proxy software and its configuration, but HTTP proxies are expected to follow the W3C Guidelines for Web Content Transformation Proxies, which states many things, but most relevantly:

• Other than to convert between HEAD and GET proxies must not alter request methods.

• If the request contains a Cache-Control: no-transform directive, proxies must not alter the request other than to comply with transparent HTTP behavior defined in RFC 2616 HTTP sections section 14.9.5 and section 13.5.2 and to add header fields as described in 4.1.6 Additional HTTP Header Fields.

• Other than the modifications required by RFC 2616 HTTP proxies should not modify the values of header fields other than the User-Agent, Accept, Accept-Charset, Accept-Encoding, and Accept-Language header fields and must not delete header fields.

• Proxies should add the IP address of the initiator of the request to the end of a comma separated list in an X-Forwarded-For HTTP header field.

• Proxies must (in accordance with RFC 2616) include a Via HTTP header field.

---

In summary, you can generally expect these HTTP headers to be changed/added by a standards-compliant proxy:

• User-Agent
• Accept
• Accept-Charset
• Accept-Encoding
• Accept-Language
• X-Forwarded-For
• Via

Erme

I don't get the part " forward requests not packets ". Do you mean that it will reconstruct the http request from the incoming packets and then modify them? – Tucker

@Ashwin: I think you're misunderstanding the HTTP protocol here. HTTP is an application protocol, which is in the application layer of the OSI model. All HTTP 'packets' are really TCP packets, and HTTP doesn't deal with packets directly (this all happens on the transport and network layers of the OSI model). – Erme

when I make a request in the bowser like "www.google.com", this request travels from the application level(browser) right to the physical level(which is the NIC). Now the the proxy server retrieves it and then decodes the physical level data to layer 2 and so on ... to transport(layer 4). here it modifies the data and then forwards it right? – Tucker

@Ashwin: You've almost got it. ALL HTTP stuff happens on layer 7 (application). When you make the request, it will go through from layer 7 down to layer 1, then at the destination (proxy server) it will go from layer 1 up to layer 7, which is where the HTTP header stuff is done. From here it will go back down to layer 1 when it is sent to "www.google.com", and so on. – Erme

@Xenon, just a detail: actually, when it comes to HTTPS requests (via CONNECT) they forward the content of the TCP packets without looking (or being able to look, unless MITM proxy) whether they're HTTP requests. – Pigpen

@Pigpen Yep, I should've included that in my answer... edited. Cheers. – Erme

If headers are modified, does the request 'terminate' at the proxy servers and the proxy servers re-initiate (establish) the connection (with the modified headers) to the application servers? – Teniafuge