e241b33f26
Some checks failed
codecov / upload (push) Failing after 13m59s
CodeQL / Analyze (push) Failing after 1s
govulncheck / govulncheck (.) (push) Failing after 1s
govulncheck / govulncheck (./cmd/protoc-gen-go-grpc) (push) Failing after 1s
govulncheck / govulncheck (./gcp/observability) (push) Failing after 1s
govulncheck / govulncheck (./security/advancedtls) (push) Failing after 1s
govulncheck / govulncheck (./stats/opencensus) (push) Failing after 1s
Testing / vet-proto (push) Failing after 1s
Testing / tests (arm, latest) (push) Waiting to run
Testing / extras (latest) (push) Failing after 1s
Testing / static checks (latest-1) (push) Failing after 1s
Testing / tests (-race, latest) (push) Failing after 1s
Testing / tests (i386, latest) (push) Failing after 1s
Testing / tests (latest) (push) Failing after 1s
Testing / tests (latest-1) (push) Failing after 1s
Stale bot / stale (push) Failing after 1s
Lock Threads / lock (push) Failing after 1s
26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# Proxy
|
|
|
|
HTTP CONNECT proxies are supported by default in gRPC. The proxy address can be
|
|
specified by the environment variables `HTTPS_PROXY` and `NO_PROXY`. (Note that
|
|
these environment variables are case insensitive.)
|
|
|
|
**NOTE**: Using CONNECT proxies via https is not supported. gRPC performs a
|
|
plaintext CONNECT handshake to establish a tunnel and does not support the
|
|
additional encryption required to secure the initial connection to the proxy
|
|
itself.
|
|
|
|
When using TLS, the gRPC traffic is encrypted end-to-end between the client and
|
|
the destination server. Even when using a CONNECT proxy without https, the
|
|
security is not compromised, as the proxy only sees the destination address and
|
|
cannot intercept the encrypted gRPC data.
|
|
|
|
## Custom proxy
|
|
|
|
Currently, proxy support is implemented in the default dialer. It does one more
|
|
handshake (a CONNECT handshake in the case of HTTP CONNECT proxy) on the
|
|
connection before giving it to gRPC.
|
|
|
|
If the default proxy doesn't work for you, replace the default dialer with your
|
|
custom proxy dialer. This can be done using
|
|
[`WithContextDialer`](https://pkg.go.dev/google.golang.org/grpc#WithContextDialer).
|