agent HTTP tools support HTTP, HTTPS and SOCKS5 proxies

Error message

agent HTTP tools support HTTP, HTTPS and SOCKS5 proxies

What it means

proxyAddress parses the proxy URL to extract host:port and only accepts http, https, socks5, and socks5h schemes (filling default ports 80/443/1080). Any other scheme yields 'agent HTTP tools support HTTP, HTTPS and SOCKS5 proxies'. It enforces the proxy types the SSRF-safe client supports.

Source

Thrown at kernel/util/httprequest.go:264

		resp.Body.Close()
		conn.Close()
		return nil, nil, fmt.Errorf("proxy CONNECT returned %s", resp.Status)
	}
	return conn, reader, nil
}

func proxyAddress(proxyURL *url.URL) (string, error) {
	port := proxyURL.Port()
	if port == "" {
		switch strings.ToLower(proxyURL.Scheme) {
		case "http":
			port = "80"
		case "https":
			port = "443"
		case "socks5", "socks5h":
			port = "1080"
		default:
			return "", errors.New("agent HTTP tools support HTTP, HTTPS and SOCKS5 proxies")
		}
	}
	return net.JoinHostPort(proxyURL.Hostname(), port), nil
}

type connectionReadCloser struct {
	io.ReadCloser
	conn      net.Conn
	done      chan struct{}
	closeOnce sync.Once
	closeErr  error
}

func newConnectionReadCloser(ctx context.Context, body io.ReadCloser, conn net.Conn) *connectionReadCloser {
	ret := &connectionReadCloser{ReadCloser: body, conn: conn, done: make(chan struct{})}
	go func() {
		select {
		case <-ctx.Done():

View on GitHub (pinned to 8641553a1f)

Solutions

Prefix the proxy address with its scheme: `http://`, `https://`, or `socks5://`
Replace SOCKS4/other proxies with a SOCKS5 or HTTP equivalent
Fix the proxy environment variable or app proxy setting to a supported scheme

Example fix

// before
proxyURL = "socks4://proxy.corp:1080"
// after
proxyURL = "socks5://proxy.corp:1080"

Defensive patterns

Strategy: validation

Validate before calling

u, err := url.Parse(proxy)
if err != nil || (u.Scheme != "http" && u.Scheme != "https" && u.Scheme != "socks5" && u.Scheme != "socks5h") {
    return errors.New("proxy must use http://, https://, socks5:// or socks5h://")
}

Type guard

func isSupportedProxy(raw string) bool {
    u, err := url.Parse(raw)
    if err != nil {
        return false
    }
    switch u.Scheme {
    case "http", "https", "socks5", "socks5h":
        return true
    }
    return false
}

Prevention

Always write the scheme explicitly in proxy URLs (http://, https://, socks5://)
Replace SOCKS4 or other exotic proxies with SOCKS5/HTTP equivalents
Audit ALL_PROXY/HTTP_PROXY environment variables for unsupported schemes

When it happens

Trigger: A proxy URL with scheme other than http/https/socks5/socks5h is passed — e.g. `socks4://`, `ftp://`, or a proxy string with no scheme at all (url.Parse leaves Scheme empty, falling into default).

Common situations: Users setting SOCKS4 or QUIC proxies in config; copying a proxy address from a provider that omits the scheme (`proxy.corp:8080` instead of `http://proxy.corp:8080`); environment variable ALL_PROXY pointing at an unsupported scheme.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/0eba288fc1150ade. Report an issue: GitHub.