Authentication, TLS, and proxy paths

Target and proxy credentials stay separate; HTTPS uses TLS to the target

Authentication, TLS, and proxy paths Target and proxy credentials stay separate; HTTPS uses TLS to the target request builder · Architecture component request builder Authorization · target credentials · Architecture component Authorization target credentials HTTP client · Architecture component HTTP client Proxy-Authorization · Architecture component Proxy-Authorization HTTP proxy · Architecture component HTTP proxy trusted certs · Architecture component trusted certs mTLS client cert · Architecture component mTLS client cert TLS to target · Architecture component TLS to target target HTTP API · Architecture component target HTTP API direct HTTP direct HTTPS proxy HTTP target CONNECT

Credential and encryption boundaries

  • • Authorization goes only to the target; Proxy-Authorization goes only to the HTTP proxy.
  • • Direct HTTPS and HTTPS after proxy CONNECT both use TLS to the target, where trusted certificates and the mTLS client certificate apply.