Elite vs anonymous proxy comes down to two headers. A transparent proxy writes your real address into X-Forwarded-For. An anonymous proxy leaves your address out but still says a proxy is there, usually with Via. An elite proxy writes neither. All three grades describe what a proxy adds to a plain HTTP request it can read, and for an https:// page it cannot read the request, so it cannot add anything.
What the three levels actually test
The grades come from proxy judges. A judge is a small script on a web server that prints back every header it received, plus the address the connection came from, and a checker sorts proxies by sending a request through each one to that script.
| Level | Your address in a header | A proxy header present | Typical headers |
|---|---|---|---|
| Transparent | yes | yes | X-Forwarded-For: <your IP>, Via |
| Anonymous | no | yes | Via, Proxy-Connection, sometimes a fake X-Forwarded-For |
| Elite | no | no | none |
X-Forwarded-For has a standard sibling. RFC 7239 defines Forwarded, as in Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43, and judges grade it the same way.
Grade tables tend to leave out one awkward line of RFC 9110: a proxy MUST send Via in each message it forwards. Follow the HTTP standard to the letter and you grade "anonymous". An elite proxy is one whose operator turned that header off, which says something about their config file and nothing about their exits.
The judge scripts are almost always served over http://, and they have to be. The test asks what the proxy wrote into the request, and a proxy can only write into a request it can see.
Paste one gateway line. Every profile mints its own exitIn Mosaic: Provider minting. One gateway line, a separate exit for every profile. Free holds 3 profiles. Pro is $49 a month for any number.
Mosaic is a desktop app
Email yourself the link and open it on your computer.
How it works: Provider minting
Why HTTPS makes every honest proxy elite
Point Chrome at an HTTP proxy and open an https:// page, and the proxy never gets the page request. It gets this:
CONNECT shop.example:443 HTTP/1.1
Host: shop.example:443
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 ...
Proxy-Authorization: Basic ...
That order (Host, then Proxy-Connection, then User-Agent, credentials last) is how Chrome's ProxyClientSocket::BuildTunnelRequest writes it. The proxy opens TCP to shop.example on port 443, answers 200, and then copies bytes both ways; RFC 9110 calls the result a tunnel, a blind relay. Chrome runs its TLS handshake with the shop through that pipe and sends GET / encrypted, with keys the proxy never had.
A Via or X-Forwarded-For would have to go inside that encrypted GET, and the proxy cannot reach it. The CONNECT headers end at the proxy. Proxy-Authorization and Proxy-Connection never reach the shop, because the shop only ever receives the request inside the tunnel.
The gateway does read the CONNECT preamble in the clear, and that part is between you and the seller. Our own relay once wrote it in a shape no Chrome uses: no User-Agent, a capital K in Keep-Alive, credentials in the wrong place (the relay that looked like a script has the byte comparison).
Most of the web is HTTPS, and on that traffic transparent, anonymous and elite proxies hand the site the same request. The grade on a seller's listing is a result from a test taken over plain HTTP.
Where the grade still means something
There are three cases, and ordinary browsing is none of them.
- Plain
http://pages. Chrome sends the whole request to the proxy in absolute form (GET http://example.com/ HTTP/1.1), so the proxy can read it and add anything. Here a transparent proxy does leak your address. - A proxy that decrypts. Corporate filters, mitmproxy, Charles, Proxyman, Fiddler and Burp end the TLS connection themselves with a certificate you trusted, so for them HTTPS is not a tunnel and they can add headers to it. Mosaic's traffic inspection (Settings › Network) routes launches through exactly these tools, which is why it is a debugging switch and not a privacy one.
- SOCKS. A SOCKS5 proxy relays a connection and never parses HTTP, so it has no header to add on either scheme.
Case one goes away if every site a profile visits is https://.
What a site sees through an elite tunnel
Perfect headers still arrive from the exit's address. The site can look up the network that owns it, check it against datacentre ranges, and ask what that address did on other sites last week. On HTTPS that reputation is what most proxy detection reads, and it is how a residential exit gets flagged with nothing wrong in its headers (why a residential IP gets detected as a proxy lists the usual causes).
Everything else comes from the browser: the TLS handshake, the timezone, Accept-Language, the fingerprint. The tunnel carries it unchanged. A browser set to New York time behind a Frankfurt exit can be caught on that mismatch alone, and no header grade measures it.
Testing a proxy in two requests
Ask httpbin for its header echo twice, through the same proxy:
curl -x http://user:pass@gateway.example:8000 http://httpbin.org/headers
curl -x http://user:pass@gateway.example:8000 https://httpbin.org/headers
A Via or X-Forwarded-For in the first answer and not the second is the proxy writing into requests it can read, and that is normal. If the https:// answer carries one too, the proxy is decrypting your traffic, which is a far worse finding than any grade.
How Mosaic handles it
Chrome's --proxy-server switch cannot carry a username and password, so a Mosaic profile whose proxy needs them browses through a relay on 127.0.0.1, one per profile, which signs in to the gateway for it. For https:// pages the relay opens a tunnel through the proxy (CONNECT to an HTTP proxy, a SOCKS connection to a SOCKS one) and copies the encrypted bytes. For plain http:// it forwards the browser's own headers in their own order and casing, and drops the hop-by-hop ones (Connection, Keep-Alive, Proxy-Authorization and the rest) that describe one link only. It adds no Via and no X-Forwarded-For.
We never grade a proxy by its headers. Before a profile opens, Mosaic checks that the proxy answers, that it tunnels, and which exit address the site will see, and the launch is refused if either of the first two fails. The same three checks by hand, with curl and a lookup of the exit's network, are in checking a proxy before you use it. What the seller can read on its side of the tunnel, down to the hostnames in each CONNECT line, is in what a proxy provider can see.
