Originally published on proxymint.
Java proxy setup that works: system properties, java.net.Proxy, HttpClient, a scoped Authenticator, the 407 fix for Basic over CONNECT, SOCKS5, OkHttp, Apache.
TL;DR
- Java has three places to set a proxy. JVM-wide system properties (https.proxyHost, http.proxyHost and their ports), a java.net.Proxy passed to one connection, or a ProxySelector on a java.net.http.HttpClient. Each one overrides the level above it for the code it touches.
- A 407 on HTTPS with correct credentials is the tunneling flag. Since Java 8u111 the JDK disables Basic authentication on CONNECT tunnels by default. Starting the JVM with -Djdk.http.auth.tunneling.disabledSchemes= (empty) fixes HttpURLConnection and HttpClient alike.
- Scope the Authenticator to the proxy. Return credentials only for requestor type PROXY or protocol SOCKS5, and only for the proxy host and port, so a website that sends a 401 never receives the proxy password.
- HttpClient cannot use SOCKS. A SOCKS proxy from its selector is skipped and the request goes direct without an error. SOCKS5 in Java means HttpURLConnection or sockets, with credentials from the default Authenticator.
Key takeaways
- Set both property pairs and the port. https.proxyHost covers https:// URLs and http.proxyHost covers http:// URLs; a missing pair sends that scheme direct, and a missing port falls back to 80 or 443.
- Clear jdk.http.auth.tunneling.disabledSchemes before networking starts. Use a -D flag on the command line, or System.setProperty as the first line of main.
- Use the HTTP proxy port with the Java 11+ client. It resolves the target hostname at the proxy through CONNECT, and HttpClient has no SOCKS support at all.
- Verify the exit, then the rotation. Compare the proxied IP with the direct one, and compare one shared client with fresh clients to see whether new exits follow new connections.
Read the full guide on proxymint, with the commands, tables and sources.
Top comments (0)