# http_proxy: Add the allowlisting proxy server \(\#59223\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/c8faadd9c81a32455c6ac3bd460230a56655bb73)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: c8faadd9c81a32455c6ac3bd460230a56655bb73

Requested commit: c8faadd9c81a32455c6ac3bd460230a56655bb73

Commit: c8faadd9c81a32455c6ac3bd460230a56655bb73

Tree: 4f390afc061fc2b545104635e180b5f960d21344

Author: Richard Feldman

Committer: GitHub

## Message

```
http_proxy: Add the allowlisting proxy server (#59223)

Third of the `http_proxy` stack. Stacked on #59217 and the
upstream-config PR — review/merge those first.

Adds the in-process HTTP/HTTPS proxy server that enforces an
`Allowlist`. It speaks HTTP CONNECT for HTTPS tunnels and forward
proxying for plain HTTP, vets resolved addresses against
loopback/private/link-local ranges to prevent DNS-rebinding past the
sandbox, pins each connection to the destination approved for its first
request (so later keep-alive requests can't escape the policy decision),
optionally chains through the upstream proxy, and bounds header sizes,
connection counts, and connect/handshake waits since its sole client is
untrusted model-driven code running inside the editor process. Includes
end-to-end tests covering allowed/denied CONNECT and HTTP forward,
IP-literal handling, DNS-rebinding denial, and upstream chaining.

Still has no callers; wired into the agent terminal sandbox in the
remaining PRs of the stack.

Release Notes:

- N/A

---------

Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
```

## Parents

- [c52d06a8f31623a536b049d0440d830fb54d82d0](https://git.cafe/gitcafe/zed/commit/c52d06a8f31623a536b049d0440d830fb54d82d0?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/c8faadd9c81a32455c6ac3bd460230a56655bb73?format=markdown)