Skip to main content
Use this article when your title uses a custom HTTP stack directly instead of xCurl and you need to debug traffic through a proxy such as Fiddler.

When to use this guidance

This guidance is most useful when one or more of the following apply:
  • Your title needs to inspect or apply proxy settings directly.
  • Your debugging workflow depends on Fiddler or another development proxy.
  • Your HTTP stack doesn’t use Schannel as a security provider and must load proxy certificates explicitly.
For general security guidance, see Best Practices for Secure Web Requests and WebSockets for Microsoft Game Development Kit Titles.

Proxy settings on XBOX and PC

When handling proxy settings on XBOX, prefer WinHttpGetProxySettingsEx with WinHttpProxySettingsTypeXBox when that path is available in your build and target environment. On XBOX, this API is the forward-looking API for reading proxy settings starting with the April 2026 Microsoft Game Development Kit (GDK). If your title targets an earlier GDK on XBOX, the XBOX-specific proxy-settings path isn’t available. In that case, manually set the proxy address and port in your HTTP stack. The certificate-loading path described later in this article still applies on those older GDKs even though the XBOX-specific proxy-address API is unavailable. PC titles can also query proxy settings through WinHTTP, but don’t copy the XBOX flow directly. On PC, WinHttpGetProxySettingsEx is asynchronous, so wait for the operation to complete before calling WinHttpGetProxySettingsResultEx and copying the returned proxy values into your HTTP stack. An example using libcurl is to resolve the proxy address with the XBOX proxy-settings API and then pass it into the stack directly. The session is opened with WINHTTP_FLAG_ASYNC and a status callback is registered so the code handles both synchronous completion and an ERROR_IO_PENDING return. The following example shows the call flow:

TLS provider behavior

Schannel-based stacks

If your stack relies on Schannel-backed TLS behavior, the console automatically applies the proxy certificate that you configure. This behavior also applies to libcurl builds that use Schannel as the TLS provider.

Non-Schannel stacks

If your stack relies on OpenSSL or another non-Schannel TLS provider, your title is responsible for explicitly loading the certificate required by the active debugging tool. Keep this certificate-loading path in your release code. On console, titles should also keep the related proxy-debugging path available in RETAIL builds so you can still diagnose proxied traffic when needed. For trust, proxy, and secure-default guidance, see Best Practices for Secure Web Requests and WebSockets for Microsoft Game Development Kit Titles.

Finding the proxy root certificate

For non-Schannel stacks, explicitly load the certificate that corresponds to the debugging tool and keep this path in your release code. The certificate location and subject depend on the tool. For example, XBOX Multiplayer Analysis Tool (XMAT) uses the certificate Xbox Multiplayer Analysis Tool Root Cert Authority in CurrentUser\Root. This example looks up that certificate and copies the DER-encoded certificate bytes into a title-owned buffer.
After this step, pass encodedCertificate into whatever certificate-loading path your TLS provider uses.

Suggested debugging workflow

  1. Configure the console proxy settings in XBOX Device Portal as described in Fiddler on XBOX devkits.
  2. If you target XBOX with the April 2026 GDK or later and your title needs to inspect proxy settings directly, use WinHttpGetProxySettingsEx with WinHttpProxySettingsTypeXBox.
  3. If your PC code path queries proxy settings through WinHTTP, wait for the asynchronous result before calling WinHttpGetProxySettingsResultEx and applying the returned proxy values.
  4. If you target an earlier GDK on XBOX or use a stack that doesn’t consume the XBOX-specific proxy settings path, set the proxy address and port manually within your title.
  5. If you use Schannel, rely on the console-applied certificate. If you use OpenSSL or another stack, retrieve the certificate for the debugging tool you’re using from the certificate store and load it explicitly.
Last modified on August 20, 2026