siyuan-note/siyuan · error

proxy CONNECT returned %s

Error message

proxy CONNECT returned %s

What it means

When connecting through an HTTP proxy, dialProxyTunnel sends a CONNECT request and requires HTTP 200. Any other status (403, 407, 502, 503...) is turned into 'proxy CONNECT returned <status>'. The proxy itself refused or failed the tunnel, so the raw status text is surfaced for diagnosis.

Source

Thrown at kernel/util/httprequest.go:248

	if proxyURL.User != nil {
		password, _ := proxyURL.User.Password()
		credentials := proxyURL.User.Username() + ":" + password
		connectReq.Header.Set("Proxy-Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(credentials)))
	}
	if err = connectReq.Write(conn); err != nil {
		conn.Close()
		return nil, nil, err
	}
	reader := bufio.NewReader(conn)
	resp, err := http.ReadResponse(reader, connectReq)
	if err != nil {
		conn.Close()
		return nil, nil, err
	}
	if resp.StatusCode != http.StatusOK {
		resp.Body.Close()
		conn.Close()
		return nil, nil, fmt.Errorf("proxy CONNECT returned %s", resp.Status)
	}
	return conn, reader, nil
}

func proxyAddress(proxyURL *url.URL) (string, error) {
	port := proxyURL.Port()
	if port == "" {
		switch strings.ToLower(proxyURL.Scheme) {
		case "http":
			port = "80"
		case "https":
			port = "443"
		case "socks5", "socks5h":
			port = "1080"
		default:
			return "", errors.New("agent HTTP tools support HTTP, HTTPS and SOCKS5 proxies")
		}
	}

View on GitHub (pinned to 8641553a1f)

Solutions

1. Check the returned status: 407 → add credentials to the proxy URL (http://user:pass@proxy:port); 403 → destination blocked by proxy policy; 502/504 → proxy cannot reach the target
2. Verify proxy settings (env HTTP_PROXY/HTTPS_PROXY or app config) are correct and current
3. Test the same CONNECT with `curl -x <proxy> https://<target>` to isolate whether the proxy or the target is at fault
4. Ask the proxy administrator to allow the destination or fix the proxy

Example fix

// before
proxy = "http://proxy.corp:8080"             // 407 Proxy Authentication Required
// after
proxy = "http://user:secret@proxy.corp:8080" // credentials supplied

if _, _, err := dialProxyTunnel(ctx, proxyURL, targetAddr); err != nil {
    var proxyErr *statusError
    if strings.HasPrefix(err.Error(), "proxy CONNECT returned ") {
        code := strings.TrimPrefix(err.Error(), "proxy CONNECT returned ")
        // 407 → add credentials; 403 → proxy policy; 5xx → proxy upstream problem
        _ = code
    }
    return err
}

When it happens

Trigger: RoundTrip through an HTTP/HTTPS proxy; the proxy responds to CONNECT with a non-200 status — auth rejected (407), destination blocked by proxy policy (403), proxy cannot reach the target (502/504), or proxy overloaded (503).

Common situations: Corporate proxy requiring credentials not supplied in the proxy URL; proxy ACL blocking the destination host/port; expired proxy credentials; target site blocked by company policy; proxy down or misconfigured upstream.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• read body failed: %s
• version request returned HTTP " + response.status
• authentication probe returned HTTP " + response.status
• boot progress request returned HTTP " + response.status
• unexpected status code: %d

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/acf76d54a1fe0d01. Report an issue: GitHub.