Mexela has recorded authenticated HTTP-proxy checks with libcurl, Python Requests, Node.js Axios, Playwright APIRequestContext, PHP Guzzle and PowerShell. The evidence differs by client: some checks confirmed the observed exit, others checked an HTTPS response, and dated browser checks now include isolated live HTTPS samples alongside earlier local fixtures. This matrix preserves those differences and the unsuccessful attempts so you can choose a setup to test in your own application.
Evidence reviewed: 12 October 2026. Historical runs remain unchanged below. The additional 12 October checks executed the cURL CLI and isolated Chromium and Firefox builds against the owned HTTPS checker; the run dates and evidence boundaries are retained. These are first-party engineering observations with dedicated test assignments, not customer testimonials, all-plan certification or future availability promises.
Read the evidence status before choosing a client
- Confirmed route: an owned source-address checker returned HTTP 200 and a fresh, valid address; the observed exit matched the configured test assignment and differed from a permitted direct control. Failed attempts remain in the denominator.
- HTTPS response check: authenticated requests returned the owned target’s expected response with destination TLS validation enabled. The record compared response-body digests with that client’s direct baseline, but did not record an observed-exit comparison.
- Local fixture only: a disposable local proxy and destination checked routing and authentication mechanics. This is not a live Mexela endpoint test.
- Untested in this record: a guide or documented configuration exists, but the listed combination has no qualifying observation here.
All live HTTPS rows below used an HTTP proxy with username/password input to reach an HTTPS destination. An HTTPS destination does not make the client-to-proxy hop an encrypted HTTPS proxy connection. Read the testing methodology for the acceptance boundaries.
Recorded live client checks
| Client, version and run date | Configured path | Recorded result | Evidence status and setup |
|---|---|---|---|
| PHP/libcurl PHP 7.0.33; libcurl 7.47.0; Linux 11 October 2026 |
Authenticated HTTP proxy to the owned HTTPS checker; fresh connections, five routes, 20 rounds. | 98 / 100 confirmed route requests; 2 failed. Direct controls: 20 / 20. Both failures belonged to one route; no credential-omission checks in this window. | Confirmed route with retained failures. Run, timing data and reproduction kit. Related cURL configuration guide; this run used the PHP binding, not the cURL CLI. |
| PHP Guzzle 7.15.5 PHP 8.4.22; CurlHandler; libcurl 8.20.0; OpenSSL 3.0.20; Windows 11 October 2026 |
Explicit proxy configuration to the owned HTTPS checker; native Windows CA validation. Five slots, two authenticated calls per slot. | 10 / 10 confirmed route requests; 0 failed. Without credentials: 5 / 5 transport failures, all libcurl error 7; no measured 407. | Confirmed route. Guzzle setup and observed checks. The unauthenticated failures do not establish authentication rejection. |
| Invoke-WebRequest PowerShell 7.6.5 Core; Windows 11 October 2026 |
Explicit proxy and ProxyCredential to the owned HTTPS checker. Five slots, two authenticated calls per slot. | 8 / 10 confirmed route requests; 2 failed. Without credentials: 4 / 5 measured proxy-tunnel 407 responses and 1 / 5 unclassified transport failure. | Confirmed route with mixed results. PowerShell setup and failure record. |
| Invoke-RestMethod PowerShell 7.6.5 Core; Windows 11 October 2026 |
Explicit proxy and ProxyCredential to the owned HTTPS checker. Separate direct control and later sequential window. | 8 / 10 confirmed route requests; 2 failed. Without credentials: 4 / 5 measured proxy-tunnel 407 responses and 1 / 5 unclassified transport failure. | Confirmed route with mixed results. REST cmdlet setup and failure record. |
| Python Requests 2.34.2 Python runtime version not retained for this live run 5 October 2026 |
Session with trust_env=False and an explicit HTTP proxy map; verified HTTPS GET to owned robots.txt. | 10 / 10 HTTPS response checks; 0 failed. Five slots, two calls each; body digests matched the corresponding direct baseline. Separate HTTP calls without credentials: 5 / 5 returned 407. | HTTPS response check; observed exit not measured in this record. Requests setup and dated observation. |
| Node.js Axios 1.20.0 Node.js runtime version not retained for this live run 5 October 2026 |
Node HTTP adapter, explicit https-proxy-agent CONNECT agent and proxy:false; verified HTTPS GET to owned robots.txt. | 10 / 10 HTTPS response checks; 0 failed. Five slots, two calls each; body digests matched that client’s direct baseline. Separate HTTP calls without credentials: 5 / 5 returned 407. | HTTPS response check; observed exit not measured. Node.js transport only; browser Axios was not tested. Axios setup and dated observation. |
| Playwright 1.62.1 APIRequestContext Node.js runtime version not retained for this live run 5 October 2026 |
request.newContext() with an explicit HTTP proxy server and separate credentials; verified HTTPS GET to owned robots.txt. | 10 / 10 HTTPS response checks; 0 failed. Five slots, two calls each; body digests matched that client’s direct baseline. Separate HTTP calls without credentials: 5 / 5 returned 407. | HTTPS response check; observed exit not measured. No browser was launched in this run. Playwright setup and API-context observation. |
| cURL CLI 8.21.0 libcurl 8.21.0; Schannel; Windows 12 October 2026 |
Executed curl.exe with an explicit HTTP proxy and username/password via transient standard input. Five dedicated assignments, two authenticated HTTPS calls each; verified destination TLS and no redirects. | 10 / 10 confirmed route requests; 0 failed. Direct control: 1 / 1. Five separate calls without credentials failed with cURL exit code 7 and no captured HTTP status; those failures do not prove authentication rejection. | Confirmed route for the executed CLI. cURL setup guide. This separate run does not replace the earlier PHP/libcurl results. |
| Chromium 151.0.7922.34 Playwright 1.62.1; Node.js 24.17.0; Windows 12 October 2026 |
Headless isolated BrowserContext navigations to the owned HTTPS source-address checker. Explicit HTTP proxy and credentials through a transient loopback TCP relay; five assignments, two fresh contexts each. | 10 / 10 confirmed route requests; 0 failed. Same-engine direct control: 1 / 1. Every authenticated observed exit matched its assignment and differed from the direct control. | Confirmed live browser route. Playwright configuration guide. No manual proxy settings, user profile, login-dialog or third-party acceptance claim. |
| Firefox 153.0 Official Playwright test build; Playwright 1.62.1; Node.js 24.17.0; Windows 12 October 2026 |
Headless isolated BrowserContext navigations with the same declared HTTP proxy, relay and HTTPS-checker procedure. Five dedicated assignments, two fresh contexts each. | 10 / 10 confirmed route requests; 0 failed. Same-engine direct control: 1 / 1. Every authenticated observed exit matched its assignment and differed from the direct control. | Confirmed live browser route for this test build. Manual configuration guide. The installed Firefox browser, manual authentication dialog and customer profiles were not tested. |
The source-address checks used https://mexela.com/proxy-checker/?format=json. The response-only checks used https://mexela.com/robots.txt. Certificate validation remained enabled and redirects were disabled. The five-slot native-client matrices each contained one direct control, ten authenticated calls and five credential-omission calls: 16 logical client calls per matrix. Those are not counts of TCP connections or authentication exchanges.
What the unsuccessful attempts mean
In the 11 October libcurl benchmark, route-1 failed in rounds 7 and 8 with libcurl errors 56 and 28 respectively; neither attempt captured an HTTP response. The case study retains both attempts and their durations. It separates successful timing distributions from the failure denominator.
Both PowerShell cmdlets failed twice on the same test slot with System.Net.Http.HttpRequestException and no captured HTTP status. Those four authenticated failures cannot be called confirmed authentication failures. A later single Invoke-WebRequest recheck returned 200 with a valid address, but did not capture the direct/expected-exit comparisons; it is excluded from the 8 / 10 route count and does not erase the earlier failures.
The Guzzle calls without credentials produced transport error 7, without a captured 407 or CONNECT status. That record does not prove that the proxy rejected authentication. The client windows were sequential, so their different results do not establish that a client or provider caused the failures. Classify the recorded layer, preserve the first error and use the proxy troubleshooting guide before changing several settings at once.
Browser fixtures are a separate evidence class
| Browser | Recorded local result | Scope and next setup |
|---|---|---|
| Google Chrome 154.0.8037.58 | 3 / 3 authenticated local navigations and 3 / 3 direct controls passed. All three no-credential phases were blocked at the fixture proxy. | Local fixture only. Programmatic browser proxy options; no public Mexela exit, HTTPS CONNECT, manual settings or native login-dialog proof. |
| Firefox 153.0 Official Playwright test build |
3 / 3 authenticated local navigations and 3 / 3 direct controls passed. All three no-credential phases were blocked at the fixture proxy. | Local fixture only. A customer Firefox profile was not tested; do not extrapolate to every Firefox installation. |
The Playwright guide also offers a separate 2 October loopback starter, tested with Node.js 24.19.0, Playwright 1.62.1 and Chromium 151.0.7922.34. Its downloadable fixture is not the 5 October APIRequestContext live run. For manual client configuration, use the Chrome, Firefox, Windows and macOS setup guide, then verify the actual browser and assignment.
Combinations without qualifying live evidence here
| Combination | Evidence status | Next acceptance check |
|---|---|---|
| SOCKS5 or SOCKS5h; encrypted HTTPS proxy hop | Untested in this matrix. HTTP-proxy results do not establish these protocol combinations. | Confirm the supplied protocol, client build and authentication method, then test the specific path independently. |
| Source-IP allowlisting, integrated/default credentials | Untested in these live rows. They used username/password input. | Test the chosen authentication method from the actual permitted source and service account. |
| Browser Axios, WebKit, manual browser or mobile setup | Untested as live Mexela routes here. The new live Chromium and Firefox test contexts do not establish browser Axios, WebKit, manual settings or mobile behavior. | Use a clean context, one authorized assignment and an owned source-address target before adding application state. |
| Environment routing, bypass rules, DNS/WebRTC privacy, city or physical location, third-party acceptance or concurrency | Not established by these results. No global compatibility or privacy conclusion follows from one request path. | Write separate acceptance criteria for each required branch and the intended destination. |
Developer clients: seven additional local observations
These observations were recorded on 12 October 2026. The retained untested rows above refer to the original live-assignment scope. The local results below establish only the named versions and fixture paths; they do not establish live SOCKS5 routes, every environment bypass rule or n8n compatibility.
The proxy and destination were owned loopback fixtures. Routes were correlated with actual upstream sockets, credentials stayed out of the destination request, and TLS checks used a disposable fixture CA without changing global trust stores. No public exit, geography, speed, uptime, anonymity, DNS or WebRTC privacy result is claimed. GitHub-hosted execution and VS Code editor networking were not tested.
| Client, version and run date | Configured path | Observed result and limits | Evidence status and next setup |
|---|---|---|---|
| HTTPX 0.28.1 sync and async Python 3.12.14; Windows 12 October 2026 |
Explicit authenticated HTTP proxy to an owned HTTP loopback destination; environment inheritance disabled. | Both sync and async clients reached the proxy route; the sync direct control stayed direct. A separate no-credential request returned 407. Proxy-Authorization was absent at the destination. | Local fixture only. HTTPX configuration and authentication; environment configuration boundaries. |
| HTTPX 0.28.1 sync CONNECT Python 3.12.14; Windows 12 October 2026 |
Authenticated HTTP proxy tunneling to the owned HTTPS fixture; normal hostname and certificate checks retained. | The disposable untrusted destination certificate was rejected. Explicitly trusting that fixture CA allowed the expected proxy route. This is not a test of an encrypted HTTPS proxy hop. | Local fixture only. HTTPX TLS and CONNECT setup. |
| HTTPX 0.28.1 sync SOCKS5 socksio 1.0.0; Python 3.12.14; Windows 12 October 2026 |
Username/password SOCKS5 to the owned HTTPS fixture, using an IP-literal destination and the explicit fixture CA. | The destination identified the SOCKS route with certificate verification enabled. No hostname DNS, DNS privacy, WebRTC or public exit was measured. | Local fixture only. HTTPX optional SOCKS setup and limits. |
| aiohttp 3.14.5 HTTP Python 3.12.14; Windows 12 October 2026 |
Request-level authenticated HTTP proxy with a bounded session and environment inheritance disabled. | The owned HTTP destination identified the proxy route and did not receive Proxy-Authorization. This observation covers the URL-credential form used in the example. | Local fixture only. aiohttp session and authentication setup. |
| aiohttp 3.14.5 CONNECT Python 3.12.14; Windows 12 October 2026 |
HTTP proxy tunneling to the owned HTTPS fixture with an explicit trusted fixture CA. | The trusted fixture request reached the expected proxy route; the untrusted destination certificate was rejected. HTTPS-to-proxy TLS-in-TLS and aiohttp SOCKS were not tested. | Local fixture only. aiohttp TLS, timeouts and CONNECT limits. |
| Windows curl 8.21.0 12 October 2026 |
Five HTTP environment cases against the authenticated proxy and owned loopback destination. | No variables and matching NO_PROXY were direct. Uppercase HTTP_PROXY, lowercase http_proxy and nonmatching NO_PROXY used the proxy. Windows variable names are case-insensitive; these HTTP cases do not establish HTTPS variable behavior. | Local fixture only. Windows environment matrix; VS Code terminal scope (editor networking untested). |
| Linux curl 8.5.0 in WSL2 Ubuntu 24.04; WSL 2.7.10.0 12 October 2026 |
Five native Linux HTTP cases; both proxy and destination ran inside WSL, without changing Windows or WSL networking settings. | No variables, uppercase HTTP_PROXY alone and matching NO_PROXY stayed direct. Lowercase http_proxy and a forced empty –noproxy bypass used the proxy. Windows-host localhost interoperability was not tested. | Local fixture only. WSL2 Linux route checks; Actions request check (local shell validation; no cloud run). |
Additional live client checks: 12 October 2026
The new run lasted from 15:29:42 to 15:30:58 UTC. It made 30 authenticated checker calls, three direct controls, five cURL credential-omission calls and ten independent geographic-source calls: 48 logical requests in total. Each checker result required HTTP 200, a valid address and a timestamp within 60 seconds; authenticated results additionally had to match the expected assignment and differ from that client’s direct control. TLS validation remained enabled. Historical counts, failures and local fixtures above are separate windows.
Browser requests used clean contexts, blocked service workers and allowed only the owned checker URL. The temporary loopback relay forwarded TCP bytes to the dedicated assignment without storing credentials or addresses; it did not substitute a local destination for the live HTTPS target. These were programmatic Playwright browser options, not manual browser settings or authentication dialogs. No DNS, WebRTC, concurrency, throughput or all-plan conclusion follows from this small sample.
Country coverage of the dedicated test routes
Ten HTTPS checks asked IPinfo and ipapi to classify their observed source addresses, once per source for each of the five dedicated assignments. All ten source addresses matched the configured exits. Both sources classified four routes as Germany. For the remaining route, IPinfo returned India and ipapi returned the United States, so its country is unresolved.
France: 0 of 5 independently confirmed routes. Romania: 0 of 5. Brazil: 0 of 5. The existing France, Romania and Brazil guides therefore have no regional timing benchmark from this run. This sample does not describe current country inventory or a physical server location. A benchmark requires an authorized dedicated assignment whose observed exit both independent sources classify in the requested country.
Turn the matching row into your own acceptance test
- Record the installed runtime, library version, handler or browser build and operating system.
- Confirm the endpoint protocol and authentication method. Select one owner for proxy routing.
- Use an owned or authorized source-address target and a permitted direct control. Keep TLS validation enabled and use finite request budgets.
- Make a small repeated authenticated sample; confirm the expected exit and retain every failure. A 200 response alone is not a route assertion.
- Test the intended application endpoint separately at conservative volume. Verify service-account behavior, bypass, sessions and concurrency only when required.
- Keep credentials, endpoint identities, actual addresses, response bodies and full exception messages out of public reports.
This page does not establish continuous uptime, all-plan support, physical server location, anonymity, DNS privacy, throughput or future availability. For measured duration from one declared window, use the route timing case study; for test design, use how Mexela tests proxy guides. Compare your verified protocol, authentication and capacity requirements with current proxy plans, then confirm inventory and test the exact workload.
Download the developer examples
Download the developer examples ZIP for the locally tested Python clients, environment checks, CI route-check files and native PHP cURL helper. The n8n workflow is a separate illustrative reference: it was not imported or executed in n8n. Read the included README for runtime versions, setup and the limits of each check.
ZIP SHA-256: 3a43f7d1e6cbb9b2917dbcf88aaa8fe1a2733c33326187cb89c9a9119aad3e20. Keep real proxy credentials and destination secrets in your approved secret store; they are absent from this archive. Start with one approved destination and compare its observation with a direct baseline.