# Elite proxy vs anonymous proxy, and why HTTPS ends it > Elite vs anonymous proxy is about X-Forwarded-For and Via on plain HTTP. Inside a CONNECT tunnel to an HTTPS site, a proxy cannot add a header at all. Source: https://mosaicbrowser.com/blog/proxy-anonymity-levels-and-https ## Elite, anonymous, transparent: proxy levels mean little on HTTPS Elite vs anonymous proxy is about X-Forwarded-For and Via on plain HTTP. Inside a CONNECT tunnel to an HTTPS site, a proxy cannot add a header at all. ![0: Headers a tunnel can add to an HTTPS request](https://mosaicbrowser.com/covers/proxy-anonymity-levels-and-https.webp) Elite vs anonymous proxy comes down to two headers. A transparent proxy writes your real address into `X-Forwarded-For`. An anonymous proxy leaves your address out but still says a proxy is there, usually with `Via`. An elite proxy writes neither. All three grades describe what a proxy adds to a plain HTTP request it can read, and for an `https://` page it cannot read the request, so it cannot add anything. ## What the three levels actually test The grades come from proxy judges. A judge is a small script on a web server that prints back every header it received, plus the address the connection came from, and a checker sorts proxies by sending a request through each one to that script. | Level | Your address in a header | A proxy header present | Typical headers | | --- | --- | --- | --- | | Transparent | yes | yes | `X-Forwarded-For: `, `Via` | | Anonymous | no | yes | `Via`, `Proxy-Connection`, sometimes a fake `X-Forwarded-For` | | Elite | no | no | none | `X-Forwarded-For` has a standard sibling. RFC 7239 defines `Forwarded`, as in `Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43`, and judges grade it the same way. Grade tables tend to leave out one awkward line of RFC 9110: a proxy MUST send `Via` in each message it forwards. Follow the HTTP standard to the letter and you grade "anonymous". An elite proxy is one whose operator turned that header off, which says something about their config file and nothing about their exits. The judge scripts are almost always served over `http://`, and they have to be. The test asks what the proxy wrote into the request, and a proxy can only write into a request it can see. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers) ## Why HTTPS makes every honest proxy elite Point Chrome at an HTTP proxy and open an `https://` page, and the proxy never gets the page request. It gets this: ``` CONNECT shop.example:443 HTTP/1.1 Host: shop.example:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 ... Proxy-Authorization: Basic ... ``` That order (Host, then `Proxy-Connection`, then `User-Agent`, credentials last) is how Chrome's `ProxyClientSocket::BuildTunnelRequest` writes it. The proxy opens TCP to `shop.example` on port 443, answers `200`, and then copies bytes both ways; RFC 9110 calls the result a tunnel, a blind relay. Chrome runs its TLS handshake with the shop through that pipe and sends `GET /` encrypted, with keys the proxy never had. A `Via` or `X-Forwarded-For` would have to go inside that encrypted `GET`, and the proxy cannot reach it. The CONNECT headers end at the proxy. `Proxy-Authorization` and `Proxy-Connection` never reach the shop, because the shop only ever receives the request inside the tunnel. The gateway does read the CONNECT preamble in the clear, and that part is between you and the seller. Our own relay once wrote it in a shape no Chrome uses: no User-Agent, a capital K in `Keep-Alive`, credentials in the wrong place ([the relay that looked like a script](https://mosaicbrowser.com/blog/the-relay-that-looked-like-a-script) has the byte comparison). Most of the web is HTTPS, and on that traffic transparent, anonymous and elite proxies hand the site the same request. The grade on a seller's listing is a result from a test taken over plain HTTP. ## Where the grade still means something There are three cases, and ordinary browsing is none of them. 1. Plain `http://` pages. Chrome sends the whole request to the proxy in absolute form (`GET http://example.com/ HTTP/1.1`), so the proxy can read it and add anything. Here a transparent proxy does leak your address. 2. A proxy that decrypts. Corporate filters, mitmproxy, Charles, Proxyman, Fiddler and Burp end the TLS connection themselves with a certificate you trusted, so for them HTTPS is not a tunnel and they can add headers to it. Mosaic's traffic inspection (Settings › Network) routes launches through exactly these tools, which is why it is a debugging switch and not a privacy one. 3. SOCKS. A SOCKS5 proxy relays a connection and never parses HTTP, so it has no header to add on either scheme. Case one goes away if every site a profile visits is `https://`. ## What a site sees through an elite tunnel Perfect headers still arrive from the exit's address. The site can look up the network that owns it, check it against datacentre ranges, and ask what that address did on other sites last week. On HTTPS that reputation is what most proxy detection reads, and it is how a residential exit gets flagged with nothing wrong in its headers ([why a residential IP gets detected as a proxy](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy) lists the usual causes). Everything else comes from the browser: the TLS handshake, the timezone, `Accept-Language`, the fingerprint. The tunnel carries it unchanged. A browser set to New York time behind a Frankfurt exit can be caught on that mismatch alone, and no header grade measures it. ## Testing a proxy in two requests Ask httpbin for its header echo twice, through the same proxy: ``` curl -x http://user:pass@gateway.example:8000 http://httpbin.org/headers curl -x http://user:pass@gateway.example:8000 https://httpbin.org/headers ``` A `Via` or `X-Forwarded-For` in the first answer and not the second is the proxy writing into requests it can read, and that is normal. If the `https://` answer carries one too, the proxy is decrypting your traffic, which is a far worse finding than any grade. ## How Mosaic handles it Chrome's `--proxy-server` switch cannot carry a username and password, so a Mosaic profile whose proxy needs them browses through a relay on 127.0.0.1, one per profile, which signs in to the gateway for it. For `https://` pages the relay opens a tunnel through the proxy (CONNECT to an HTTP proxy, a SOCKS connection to a SOCKS one) and copies the encrypted bytes. For plain `http://` it forwards the browser's own headers in their own order and casing, and drops the hop-by-hop ones (`Connection`, `Keep-Alive`, `Proxy-Authorization` and the rest) that describe one link only. It adds no `Via` and no `X-Forwarded-For`. We never grade a proxy by its headers. Before a profile opens, Mosaic checks that the proxy answers, that it tunnels, and which exit address the site will see, and the launch is refused if either of the first two fails. The same three checks by hand, with curl and a lookup of the exit's network, are in [checking a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it). What the seller can read on its side of the tunnel, down to the hostnames in each CONNECT line, is in [what a proxy provider can see](https://mosaicbrowser.com/blog/what-a-proxy-provider-can-see). ## Questions ### What is the difference between an elite proxy and an anonymous proxy? On a plain HTTP request, an anonymous proxy hides your address but announces itself, usually with a Via header. An elite proxy adds no proxy headers at all. A transparent proxy passes your real address on in X-Forwarded-For. ### Do proxy anonymity levels matter for HTTPS sites? Hardly. For an https:// page the browser asks the proxy for a CONNECT tunnel and encrypts the request inside it, so the proxy cannot read or add headers. Only a proxy that decrypts your traffic with a certificate you installed can. ### Is a SOCKS5 proxy elite? At the HTTP level, yes. SOCKS5 relays a connection and never touches the request, so it has nowhere to write Via or X-Forwarded-For. ### If headers are clean, can a site still tell I use a proxy? Yes. A site sees the exit address, which network owns it and how that address has behaved before. That reputation, not a header, is what most proxy detection reads on HTTPS. ### How do I test a proxy's anonymity level myself? Fetch a header echo page through the proxy twice, once over http:// and once over https://, and compare what came back. The http:// copy shows what the proxy adds; the https:// copy shows what a site behind TLS receives. ## Related [How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it. [Our proxy relay told the gateway it was a script](https://mosaicbrowser.com/blog/the-relay-that-looked-like-a-script): Chrome sends Proxy-Connection: keep-alive, lower case, to every proxy. Our relay sent Keep-Alive, no User-Agent and Connection: close, until we copied Chrome. [The residential IP several detectors already knew](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy): A residential proxy can be detected as a proxy because it is one. On one Wichita exit, FingerprintJS and incolumitas never loaded in three rounds. [What your proxy provider can and cannot see](https://mosaicbrowser.com/blog/what-a-proxy-provider-can-see): Over HTTPS a proxy provider sees each hostname, port, time and byte count, never the pages or passwords. Over plain HTTP it sees everything you send. [Browser fingerprint: what a site can read about your machine](https://mosaicbrowser.com/glossary/browser-fingerprint): A browser fingerprint is the set of values a site reads about your browser and computer, which together recognize you without cookies. What goes into one. [Detecting a proxy with two clocks](https://mosaicbrowser.com/blog/proxy-detection-by-latency): A server times the TCP handshake to the exit and a round trip to the browser. Behind a proxy the second is longer, and the gap is the tunnel. ["Unlimited bandwidth" proxies and where the limit really is](https://mosaicbrowser.com/blog/unlimited-bandwidth-proxies): An unlimited bandwidth residential proxy still has a limit. It moves to threads, ports, speed or a fair-use clause, and the terms say which one. [The proxy bill is usually bigger than the browser bill](https://mosaicbrowser.com/blog/proxy-bill-bigger-than-browser): Past a couple of dozen profiles, the exits cost more each month than the anti-detect browser. That is why we price per month, not per profile. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.