Use Node.js fetch with an HTTP proxy

Check the endpoint before running the example

Wait for a ready order, confirm time and traffic remain, and copy the proxy IP, port, username and password. Use an HTTP proxy URL even when the destination starts with HTTPS. The HTTPS connection uses a CONNECT tunnel.

Dropstride supports public destination ports 80 and 443. The HTTP connection to the proxy does not encrypt proxy authentication, so use a trusted network and keep credentials private. Do not share command output containing credentials.

Understand HTTP proxies and HTTPS CONNECT →

Use the tested client versions

The local fixture used Node.js 22.14.0 and undici 6.29.1. The example imports fetch and ProxyAgent from the same package. Install that pinned package in a separate test directory with npm install undici@6.29.1. This is a reproducibility pin, not a claim that it is the newest release.

The snippet uses an explicit dispatcher. It does not assume that global fetch reads HTTP_PROXY in every Node.js version. For a different supported runtime or Undici version, re-run a connection check before adopting the configuration.

Run the Node.js example

Save this as node-proxy.mjs. Supply PROXY_PASSWORD using your secret manager or a temporary environment variable, then run node node-proxy.mjs. In Bash, read -rs PROXY_PASSWORD prompts without echo; run export PROXY_PASSWORD afterward and unset PROXY_PASSWORD when finished.

The token is Base64 encoding, not encryption. Do not log it. The code preserves destination certificate checks, disallows redirects in this single-destination diagnostic, consumes the response, and closes the dispatcher.

import { ProxyAgent, fetch } from 'undici';
import { createInterface } from 'node:readline/promises';

const input = createInterface({ input: process.stdin, output: process.stdout });
const host = (await input.question('Proxy IP: ')).trim();
const port = Number(await input.question('Proxy port: '));
const username = (await input.question('Proxy username: ')).trim();
input.close();
// Supply PROXY_PASSWORD from a secret manager or a temporary environment variable.
// Never commit it, include it in a URL log, or pass it as a command-line argument.
const password = process.env.PROXY_PASSWORD;
if (!password || !Number.isInteger(port) || port < 1 || port > 65535) {
  throw new Error('Provide PROXY_PASSWORD and a valid proxy port.');
}
const dispatcher = new ProxyAgent({
  uri: `http://${host}:${port}`,
  token: `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`,
});
try {
  const response = await fetch('https://example.com', {
    dispatcher,
    signal: AbortSignal.timeout(30_000),
    redirect: 'error',
  });
  await response.arrayBuffer();
  console.log('Destination HTTP status:', response.status);
  if (!response.ok) process.exitCode = 1;
} catch {
  console.error('Connection failed. Check rental status, proxy fields, network and TLS trust.');
  process.exitCode = 1;
} finally {
  await dispatcher.close();
}

Download the Node.js fetch example →

Handle failures without logging secrets

A destination response such as 403 arrives as a Response object when the tunnel succeeds. A proxy refusal or TLS failure can reject the fetch promise. This example reports a generic connection error because dumping an exception tree into shared logs can expose sensitive configuration.

The 30-second AbortSignal applies to this request. For a real application, choose a timeout that matches its workload and handle cancellation. Do not repeatedly retry a completed denial or an exhausted rental.

What we actually tested

On 7 November 2026, a controlled local proxy accepted the authenticated request and relayed it to an isolated HTTP or HTTPS origin. The HTTPS certificate was verified against a local test certificate authority; verification was not disabled. The origin received no Proxy-Authorization header.

This proves the demonstrated protocol configuration in the listed versions. It does not measure a live Dropstride public exit IP, cloud availability, retailer acceptance, purchasing bots, speed or checkout success. After delivery, use a public IP-check service you trust to verify the assigned exit IP separately.

Read the sanitized protocol test results →

How we review and test published guides →