Re: [cinjug-users] Java Browser -- proxy, authentication, and https

["Eric Bardes" <ericbardes@xxxxxxxxx>]

There is a post about using the Apache Commons library which I must
agree with.  So unless there are specific policy restrictions against
using it, I would.

SSL introduces some new problems.  One of the goals of SSL in addition
to encrypting the data is to validate the remote endpoint of a
connection.  The remote endpoints sends a certificate to the browser
which validates the certificate against a hard-coded list of
certificate agencies distributed with the browser.

When you connect through a proxy server, the proxy server must have a
mechanism can not interfere with the SSL session otherwise SSL can not
be used validate the endpoint and SSL would not be able to protect the
data transport.

Most proxy servers add an HTTP method called CONNECT in addition to
GET and POST.  The first part of the connection is done non-SSL and
the second part is then SSL.  The web browser connects to the proxy
server in the clear and sends a request to the proxy server something
like:

CONNECT https://www.ecommerce.com:443/purchase HTTP/1.0
Proxy-Authorization: <AUTH-STRING>

The proxy server parses the HTTP headers and then has to provide a
transparent connection between the browser (which switches to SSL at
this point) and the remote site specified in the header.

-- 
Cheers,
Eric Bardes