In TLS 1.2 / HTTP(S) context, plaintext target hostname could potentially leak in 3 different ways:
- In DNS query prior to TCP/TLS/HTTP connection.
- In TLS handshake, ClientHello message, in SNI extension.
- In HTTP Host header.
DNS leakage can be prevented by using e.g. DoH/DoT. HTTP Host header leakage is prevented through TLS encryption. This leaves us with SNI leakage to address.
Which proxy types prevent leaking plaintext SNI and how?
Please note I'm asking explicitly about proxies, not ESNI, domain fronting or other similar means.