{"version":"2.1.268","anchor":"experimental-in-process-tls-termination-and-upstream-parent","canonical_anchor":"experimental-in-process-tls-termination-and-upstream-parent","heading":"Experimental in-process TLS termination and upstream parent-proxy support added to sandbox network config","tier":"soon","area":"Sandbox Network","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/experimental-in-process-tls-termination-and-upstream-parent","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### Experimental in-process TLS termination and upstream parent-proxy support added to sandbox network config\n\nSandbox can now terminate HTTPS itself and route traffic through an upstream proxy, both experimental\n\n**What**\n\nTwo new experimental sandbox network settings:\n\n- `network.tlsTerminate` lets the sandbox terminate HTTPS connections itself, making request and response bodies visible to request filtering and credential injection; an `excludeDomains` option opts specific hosts (such as ones using certificate pinning) out of this.\n\n- `network.parentProxy` lets the sandbox's proxy route outbound traffic through an upstream HTTP proxy, falling back to the `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables if not explicitly set.\n\nCredential masking now requires `tlsTerminate` to be turned on, unless you explicitly opt out with `allowPlaintextInject` (off by default).\n\n**Why**\n\nTerminating TLS in-process lets the sandbox actually inspect and mask credentials inside encrypted traffic instead of only seeing opaque bytes, but both features are marked experimental, so behavior may still change.\n\n- Area: Sandbox Network\n- Names: `network.tlsTerminate`\n- Tier: Nothing to try yet\n- Useful: 4\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}