Plain-HTTP requests bypass the -mitm and -tunnel host lists #7

New issue

Closed

opened 2026-10-26 20:23:17 +00:00 by mikluko · 0 comments

mikluko commented

2026-10-26 20:23:17 +00:00

Owner

Router.Default forwards every absolute-URI (non-CONNECT) request without matching its host. With -mitm example.com alone, curl -x http://127.0.0.1:8080 http://anything.test/ is still proxied, while a CONNECT to the same host is refused.

Non-CONNECT requests should go through the same host patterns as CONNECT, and be refused when nothing matches.

`Router.Default` forwards every absolute-URI (non-`CONNECT`) request without matching its host. With `-mitm example.com` alone, `curl -x http://127.0.0.1:8080 http://anything.test/` is still proxied, while a `CONNECT` to the same host is refused. Non-`CONNECT` requests should go through the same host patterns as `CONNECT`, and be refused when nothing matches.

mikluko added the

bug

label

2026-10-26 20:23:17 +00:00

mikluko referenced this issue from a commit

2026-10-26 20:57:06 +00:00

Plain-HTTP requests obey the CONNECT host rules

mikluko referenced this issue from a pull request that will close it,

2026-10-26 20:57:12 +00:00

Plain-HTTP requests obey the CONNECT host rules #30

mikluko closed this issue

2026-10-26 20:57:45 +00:00