ECONNRESET through a proxy: find which side reset

Most likely first.

1. A reused keep-alive connection was already closed. Connection pools keep idle sockets for the next request. If the proxy or the site closed one after its own idle timeout, the next request goes out on a dead socket and gets a reset. This is the usual cause of occasional resets in long-running jobs.
2. The wrong protocol for the port. An https:// proxy URL sends TLS to the proxy; on a port that expects plain HTTP the handshake fails or is reset. urllib3 recognises the case and says Your proxy appears to only use HTTP and not HTTPS. Sending HTTP to a SOCKS5 port fails the same way.
3. The proxy refused and closed. Many proxies close the connection after an error response such as 407. A client that keeps writing to it, or reuses it, sees a reset or socket hang up instead of the status.
4. The website reset the connection. Some sites reset connections they refuse, often during the TLS handshake or after too many requests.
5. The exit went away mid-transfer. A residential exit is a household connection that can drop at any time. Long downloads and long-lived connections are the ones that notice.
6. Something on your side. NAT gateways and firewalls drop connections that stay idle, which breaks WebSockets and long polls. Antivirus HTTPS scanning, VPN clients and company TLS inspection can reset connections they decide to block.

1. 1Reproduce with curl to see the stage

   (56) with no answer to CONNECT: the proxy reset before replying. (35) after 200 Connection established: the reset came during TLS with the site. (56) after data arrived: the transfer was cut.

   Watch the stagesCopy

   curl -v -x http://HOST:PORT -U "USER:PASS" https://TARGET/ -o /dev/null

2. 2Check the scheme against the port

   The proxy URL's scheme describes the connection to the proxy, not to the site, so it is http:// for a plain proxy port even when the site is https://.

   Plain HTTP and TLS to the proxyCopy

   # Plain HTTP to the proxy
   curl -v -x http://HOST:HTTP_PORT -U "USER:PASS" https://example.com/ -o /dev/null
   # TLS to the proxy, only on a port that offers it
   curl -v -x https://HOST:HTTPS_PORT -U "USER:PASS" https://example.com/ -o /dev/null

3. 3Turn off connection reuse for one run

   If the resets stop with keep-alive off, stale pooled sockets were the cause. In Node.js, create the agent with keepAlive: false; in Python, send Connection: close. With logging.basicConfig(level=logging.DEBUG), urllib3 logs Resetting dropped connection when it finds a pooled socket closed.

   Python: one connection per requestCopy

   r = requests.get(url, proxies=proxies, headers={"Connection": "close"}, timeout=30)

4. 4Note the idle time

   Log how long each connection was open and idle when it failed. Resets at the same idle age point at an idle timeout somewhere on the path. NODE_DEBUG=net,tls node app.js prints socket events in Node.js.

• Retry requests that are safe to repeat

  A reset on a reused socket almost always succeeds on a fresh one, so retry once or twice with a short backoff.

  Python requests with urllib3 retriesCopy

  import requests
  from requests.adapters import HTTPAdapter
  from urllib3.util.retry import Retry
  
  proxy = "http://USER:PASS@HOST:PORT"
  retry = Retry(total=3, connect=2, read=2, backoff_factor=0.5,
                allowed_methods=["GET", "HEAD", "OPTIONS"])
  session = requests.Session()
  session.mount("http://", HTTPAdapter(max_retries=retry))
  session.mount("https://", HTTPAdapter(max_retries=retry))
  session.proxies = {"http": proxy, "https": proxy}
  
  r = session.get("https://example.com/", timeout=(10, 60))

• The same in Node.js

  If resets follow idle pauses, close idle sockets sooner than the far side does, or create the agent with keepAlive: false.

  Node.js with https-proxy-agentCopy

  import https from "node:https";
  import { HttpsProxyAgent } from "https-proxy-agent";
  
  const agent = new HttpsProxyAgent("http://USER:PASS@HOST:PORT", { keepAlive: true });
  
  function get(url, attempt = 0) {
    return new Promise((resolve, reject) => {
      https.get(url, { agent }, resolve).on("error", (err) => {
        if (err.code === "ECONNRESET" && attempt < 2) {
          setTimeout(() => get(url, attempt + 1).then(resolve, reject), 500 * (attempt + 1));
        } else {
          reject(err);
        }
      });
    });
  }

• Fix the setup

  Use http:// for a plain HTTP proxy port, https:// only on a port that offers TLS to the proxy, and socks5h:// only on a SOCKS5 port. Log error responses such as 407 before your client discards them. For WebSockets and other long-lived connections, send pings more often than the shortest idle timeout on the path, and reconnect when they stop.

• Common system errors — Node.js documentation
• ConnectionResetError — Python documentation
• urllib3 Retry — urllib3 documentation
• Transmission Control Protocol (RFC 9293) — IETF / RFC Editor