HttpClient Proxy in .NET 8: Setup and Connection Reuse

Implementation steps

1. 1

   Configure an explicit handler

   Create the handler before the first request and configure its proxy once. The example uses SocketsHttpHandler because connection behavior is part of the access profile. The URI contains the actual gateway scheme, host and port, while the username and password remain separate. Confirm that the chosen product supports that scheme; an HTTPS destination does not by itself mean the gateway URI starts with HTTPS.

   The pool lifetime and connection limits below are illustrative starting points, not KAIROXO service guarantees. Keep normal TLS certificate validation enabled. A certificate error needs investigation of the endpoint, trust chain and environment, rather than an accept-all certificate callback.

   using System.Net;using System.Text.Json;static string Required(string name) =>    Environment.GetEnvironmentVariable(name) is { Length: > 0 } value        ? value : throw new InvalidOperationException("Missing " + name);var endpoint = new Uri(Required("PROXY_URI"));if (!string.IsNullOrEmpty(endpoint.UserInfo))    throw new InvalidOperationException("Keep credentials out of PROXY_URI");using var handler = new SocketsHttpHandler{    Proxy = new WebProxy(endpoint) { Credentials = new NetworkCredential(        Required("PROXY_USERNAME"), Required("PROXY_PASSWORD")) },    UseProxy = true,    ConnectTimeout = TimeSpan.FromSeconds(10),    PooledConnectionLifetime = TimeSpan.FromMinutes(5),    MaxConnectionsPerServer = 4,    AllowAutoRedirect = false};using var client = new HttpClient(handler) { Timeout = TimeSpan.FromSeconds(30) };using var deadline = new CancellationTokenSource(TimeSpan.FromSeconds(20));using var response = await client.GetAsync("https://httpbin.org/ip", deadline.Token);response.EnsureSuccessStatusCode();var payload = await response.Content.ReadAsStringAsync(deadline.Token);using var diagnostic = JsonDocument.Parse(payload);if (!diagnostic.RootElement.TryGetProperty("origin", out _))    throw new InvalidOperationException("Unexpected diagnostic response");// Inspect the exit locally; never log response bodies or proxy credentials.Console.WriteLine("Diagnostic succeeded; inspect the exit before scaling.");

2. 2

   Reuse the client deliberately

   For a continuously running worker, retain a long-lived client and its handler instead of recreating them for every URL. Disposing a response and disposing the whole connection pool are different decisions. Consume or dispose each response promptly so subsequent work can use available connections. Set a finite pooled-connection lifetime when your environment needs periodic DNS refresh.

   In a hosted application, an appropriately configured IHttpClientFactory is another supported lifetime strategy. Keep configuration ownership clear: factory-managed handlers can outlive an individual client. If a task switches credentials, proxy routing or isolation requirements, use a deliberately separate handler profile rather than mutating a handler that has already sent traffic.

3. 3

   Verify the network path

   Run the diagnostic from the same container, worker account or machine as the future job. Examine the returned origin locally and compare it with the expected network behavior. For a fixed endpoint, check repeatability; for a rotating profile, assess region and session rules instead of demanding a single permanent address. A JSON response with the expected field is only a shape check, not proof of a particular country.

   Repeat a small number of requests, then test one authorized target with the same client. Keep the endpoint, time and route profile in the test record, but exclude credentials and response bodies from centralized logging. A direct request from your laptop is not a substitute for checking the deployed worker's outbound path.

4. 4

   Bound deadlines and retries

   ConnectTimeout limits connection establishment, while the cancellation token bounds the end-to-end diagnostic operation. HttpClient.Timeout supplies another outer limit; the earlier cancellation wins. Carry cancellation through reading and parsing instead of assuming that receiving response headers finishes the job. For large downloads, use streaming and an explicit content-size policy suited to the task.

   Retry only operations that are safe to repeat, with a finite attempt budget and a delay. An authentication failure requires configuration review; repeated password attempts are not recovery. A destination's rate limit requires slowing or pausing that destination's workload. Retrying every failure immediately can exhaust sockets, spend traffic allowance and conceal the original problem.