{"record":{"id":"e5e264a1226e4f21","repo":"valyala/fasthttp","slug":"could-not-connect-to-proxy-addr-s-status-code","errorCode":null,"errorMessage":"could not connect to proxy addr: %s status code: %d","messagePattern":"could not connect to proxy addr: (.+?) status code: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"fasthttpproxy/dialer.go","lineNumber":270,"sourceCode":"\tif auth != \"\" {\n\t\treq += \"Proxy-Authorization: Basic \" + auth + \"\\r\\n\"\n\t}\n\treq += \"\\r\\n\"\n\t_, err = conn.Write([]byte(req))\n\tif err != nil {\n\t\t_ = conn.Close()\n\t\treturn nil, err\n\t}\n\tres := fasthttp.AcquireResponse()\n\tdefer fasthttp.ReleaseResponse(res)\n\tres.SkipBody = true\n\tif err = res.Read(bufio.NewReaderSize(conn, 1024)); err != nil {\n\t\t_ = conn.Close()\n\t\treturn nil, err\n\t}\n\tif res.Header.StatusCode() != 200 {\n\t\t_ = conn.Close()\n\t\terr = fmt.Errorf(\"could not connect to proxy addr: %s status code: %d\", proxyAddr, res.Header.StatusCode())\n\t\treturn nil, err\n\t}\n\treturn conn, err\n}\n\n// Cache authentication information for HTTP proxies.\ntype proxyInfo struct {\n\tauth string\n\taddr string\n}\n\nfunc addrAndAuth(pu *url.URL, authCache *sync.Map) (proxyAddr, auth string) {\n\tif pu.User == nil {\n\t\tproxyAddr = pu.Host + pu.Path\n\t\treturn proxyAddr, auth\n\t}\n\tif authCache != nil {\n\t\tif v, ok := authCache.Load(pu); ok {","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/fasthttpproxy/dialer.go#L252-L288","documentation":"fasthttpproxy's httpProxyDial sends a CONNECT request through an HTTP proxy and expects a '200 Connection established' response. When the proxy replies with any non-200 status code, the connection is closed and this error is returned with the proxy address and the actual status code, indicating the proxy refused the tunnel.","triggerScenarios":"Calling fasthttpproxy.FasthttpHTTPDialer / FasthttpHTTPDialerTimeout (or the proxy transport built on it) when the target host requires the CONNECT method and the proxy responds 403/407/502 etc. — e.g. proxy requires authentication, blocks the destination, or is not actually an HTTP proxy. The test TestHTTPProxyDialRejectsTargetAddrContainingNewlines shows it also fires when header injection via the target address is rejected.","commonSituations":"Corporate proxies rejecting CONNECT to non-whitelisted hosts; missing Proxy-Authorization for a proxy that demands credentials; pointing the dialer at a SOCKS or plain-HTTP endpoint that answers 4xx/5xx to CONNECT; a target address containing '\\r\\n' being rejected by the proxy.","solutions":["Check the status code in the message: 407 means add proxy authentication (use FasthttpHTTPDialerProxy with an auth URL like http://user:pass@host:port), 403/405 usually means the host is blocked or the proxy does not allow CONNECT","Verify the proxy address actually speaks HTTP CONNECT (not SOCKS — use fasthttpproxy's SOCKS dialer for socks5:// proxies)","Sanitize/validate the target host string to exclude CR/LF and spaces before dialing","Test the same request with curl -x proxy:port to confirm the proxy policy outside your code"],"exampleFix":"// before\nd := fasthttpproxy.FasthttpHTTPDialer(\"proxy.corp.local:3128\")\n// after — include credentials so the proxy does not answer 407\nd := fasthttpproxy.FasthttpHTTPDialerTimeout(\"user:pass@proxy.corp.local:3128\", 10*time.Second)","handlingStrategy":"try-catch","validationCode":"if strings.ContainsAny(targetAddr, \"\\r\\n \") {\n    return fmt.Errorf(\"invalid target address: %q\", targetAddr)\n}","typeGuard":"func isPrintableHost(addr string) bool {\n    for _, r := range addr {\n        if r <= 0x20 || r == 0x7f { return false }\n    }\n    return len(addr) > 0\n}","tryCatchPattern":"conn, err := dialer.Dial(addr)\nif err != nil {\n    var perr *fasthttpproxy.ProxyError // if wrapped\n    if strings.Contains(err.Error(), \"status code: 407\") {\n        // refresh proxy credentials and retry once\n    }\n    return fmt.Errorf(\"proxy tunnel rejected: %w\", err)\n}","preventionTips":["Embed proxy credentials in the proxy URL (user:pass@host:port) when required","Confirm the proxy permits CONNECT to your destination hosts","Validate hostnames against a strict pattern (no whitespace/control chars)","Monitor the status code embedded in the error to distinguish auth (407) vs policy (403) failures"],"tags":["network","proxy","http-connect","fasthttp"],"backgroundTag":"proxy-connect-refused","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}