OptionalnameNames this proxy in the plain-text refusals it sends. Default "xmpp-httpx".
OptionalonCalled with upstream failures, for the operator's log.
OptionaltimeoutUpstream connect + first-byte deadline. Default 30 s.
OptionalupstreamExtra CA certificates (PEM) to trust for HTTPS origins, for a private CA on the exit's network. Certificate validation itself is never optional.
A forward proxy handler: the destination comes from the request, not from a fixed origin (compare
createOriginProxyHandler, a reverse proxy).resourcein absolute-form (https://host/path) names the target and its scheme; the request's own Host is ignored, as forward proxies do./path) with a Host header is plainhttp://, for XEP-0332 clients that know nothing of absolute-form.Every connection goes through the destination policy's
lookup, so the address that is checked is the address that is dialled. Redirects are passed back, never followed: following one would be a second request the policy never saw (and the browser follows them anyway).