https - 在 HTTPS 代理中响应 403

Question

我想通过响应 403 来使用我的代理阻止某些站点。我在 HTTP 代理中以这种方式成功响应，但是当我获得 CONNECT 方法时，我响应:
HTTP/1.1 403 禁止访问
状态:403 禁止访问
委托(delegate)代理人:smth
连接:关闭
但是用户仍然得到 ERR_TUNNEL_CONNECTION_FAILED。我该怎么做才能为用户提供友好的 403 错误？

Answer 1

RFC 2817不禁止 4xx 代码，并且 Draft “4. Extensibility” 部分指出

"The tunneling handshake is freely extensible using the HTTP/1.x headers;"

但是出于安全原因，似乎所有浏览器都决定忽略几乎所有非 2xx 代码。

这里是一些错误报告:

1. https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/dd565641(v=vs.85)

Internet Explorer 8 has a feature that ensures that the secure connection is made all the way to the target server. If it isn't, then no page is displayed.

1. https://bugzilla.mozilla.org/show_bug.cgi?id=479880

I realize that I'm way late to the party here, but [...] this fix is terrible for proxy admins (myself included). Our proxy returns a 403 forbidden for filtered SSL content and an error page about why the content is blocked, and Firefox just drops all of it on the floor

1. https://bugs.chromium.org/p/chromium/issues/detail?id=7338

原来是这样。