relax HTTPS only restriction in HTTPS_PROXY

[bcwu]

Description

We have reports of users unable to use rsconnect-python to access Connect because they must use HTTP only proxy behind their corporate VPN/VPCs .

Background

This HTTPS only limitation was original designed to require a degree of security.

The initial use case for HTTPS_PROXY was for our users to access a remote resource outside of their corporate VPN/VPC, e.g. logging into a Connect instance hosted by a cloud provider directly from their home. In that scenario, the user needs to establish a secure connection from their home to the cloud instance via HTTPS; otherwise, their credentials would be exposed in plain HTTP.

WITHIN a corporate VPN/VPC, use of plain HTTP is more common because traffic within their VPN/VPC is isolated and filtered from the outside internet. If a resource, e.g. Connect, is within the corporate firewall, then it should be accessible without any type of proxy; however, some corporate VPN/VPCs configurations still require internal proxies to access resources, and these proxies use plain HTTP.

[ekungurov]

There is nothing insecure in using HTTP proxy to access HTTPS url, as long as it is proxy without SSL bumping.

Note a comment here: https://superuser.com/questions/1575387/am-i-secured-if-i-use-http-proxy-with-https-website-and-how-i-can-check-if-my-p
Nevertheless it has -1 vote, it actually states correctly as long as we are speaking about nice-behaving proxies without ssl-bump

Non-transparent HTTP proxy connection will use CONNECT method and all protected traffic will be tunneled, still encrypted.

On the other hand, if a proxy behaves with SSL bumping, you either will get all kinds of HTTPS/SSL certificate warnings (because certificate would be replaced for SSL bumping), or the company-issued certificate used for SSL bumping will be already added to trusted certificates by your system administrator.\

I even don' mention that NO_PROXY environment variable exists, and maybe it is honored when making HTTP/HTTPS requests (but I am not sure).

The next statement is probably insignificant, but modern proxy implementations also support peek-and-splice which purpose is to don't interfere to encrypted (protected) traffic, but at the same time be able to extract URL and URI from client's request.

Please don't break HTTP proxy functionality in further releases.

[bcwu]

Thanks for the information, and apologies for the inconvenience.