How to Set Up an Oblivious HTTP Relay and Gateway (RFC 9458 Guide)

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

To deploy Oblivious HTTP (OHTTP), you need three cooperating roles: a client, a relay, and a gateway. The client encodes an inner HTTP request as Binary HTTP and encrypts it with HPKE using the gateway’s authenticated public-key configuration. The relay forwards the resulting ciphertext over HTTPS, while the gateway decrypts the request, sends it only to an authorized target, and encrypts the response on its way back. The relay and gateway should be operated separately, and both network legs must use HTTPS.

What an OHTTP deployment contains

RFC 9458, published by the IETF in January 2024, describes OHTTP as “a protocol for forwarding encrypted HTTP messages.” It is designed for privacy-sensitive request patterns in which a relay can separate a client’s network identity from the gateway that processes the application request.

#	Preview	Product	Price
1		WatchGuard Firebox M295 High Availability Unit with 3 Year Standard Support - HA Device for...	$2,185.11	Buy on Amazon

An OHTTP system is not a universal privacy wrapper for an existing web application. It works best for stateless or nearly stateless exchanges where each request can stand on its own. Applications that depend on cookies, sessions, login state, or other information carried from one HTTP request to the next usually need redesign before OHTTP is a good fit.

Before the first request, the client needs three pieces of configuration: the relay resource identity, the gateway resource identity, and an authenticated gateway key configuration containing the HPKE public-key details, key identifier, and algorithm parameters. RFC 9458 describes a one-to-one relay-to-gateway mapping rather than a relay that chooses an arbitrary gateway for every request.

#1 Best Overall

WatchGuard Firebox M295 High Availability Unit with 3 Year Standard Support - HA Device for Failover, Requires Matching Primary - Not a Standalone Device - Rackmount Firewall (WGM295000+WGM2951603)

• High Availability (HA) redundant unit for resilient failover and uptime. Operates only as the secondary in an HA pair and must be paired with a primary WatchGuard Firebox of the same model for synchronization and failover. Not a standalone appliance.
• WatchGuard Firebox M295 High Availability Unit with 3 Year Standard Support License (WGM29501603) - The Firebox M295 combines enterprise-grade security with multi-gig connectivity, SD-WAN, TLS decryption, and proxy-based inspection in a compact rackmount design.
• Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
• Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
• Interfaces and continuity: 4x 2.5Gb RJ45, 4x 1Gb RJ45, 2x 10Gb SFP+ with VLANs and link aggregation, plus RIP, OSPF, BGP, and high availability to keep sites online.

$2,185.11

Buy on Amazon

How an OHTTP request works

1. Create the inner request. The client constructs the HTTP method, target path, headers, and body intended for the application gateway. Any user identifier placed here remains visible to the gateway after decryption.
2. Encode it as Binary HTTP. The client serializes the inner request using the Binary HTTP message format expected by OHTTP.
3. Encrypt for the gateway. Using the selected gateway key configuration, the client performs HPKE encryption and produces the encapsulated request.
4. Send ciphertext to the relay. The basic OHTTP exchange is a POST to the relay containing the encapsulated request. The client connects to the relay over HTTPS.
5. Forward without inspection. The relay sends the encapsulated bytes to its configured gateway over a separate HTTPS connection. It returns the gateway’s encapsulated response to the client.
6. Process at the gateway. The gateway decrypts and decodes the inner request, checks that its target is allowed, then handles or forwards that request.
7. Return an encrypted response. The gateway encapsulates the response for the client. The client decrypts and decodes it after receiving it through the relay.

The relay can observe which gateway it contacts, timing, connection information, and encrypted message lengths. It cannot read the application data when the protocol and intermediary are configured correctly. A gateway can see the decrypted request and the network connection from the relay, but it should not be able to associate that request with the client’s direct network address.

Plan the trust boundaries before installing software

Keep relay and gateway administration separate

RFC 9458’s privacy model depends on the relay and gateway not being controlled as one all-seeing service. Use separate operators, accounts, or administrative domains whenever the threat model requires unlinkability. The gateway and the final application target may be colocated; that does not by itself reveal the client’s address to the target. The critical separation is between the party that receives the client connection and the party that decrypts the request.

Define the permitted target set

Decide exactly which origin, paths, methods, and content types the gateway will serve. The gateway must have a policy mechanism such as an allowlist. Never turn it into a generic forward proxy that accepts a destination supplied by the client. Restricting destinations also makes authorization and abuse monitoring practical.

Decide what privacy you actually need

OHTTP separates network identity from the decrypted request; it does not erase identifiers deliberately included in that request. Names, email addresses, account IDs, cookies, authorization headers, device identifiers, and distinctive payloads can identify a user to the gateway. Review application telemetry and crash reporting as well as request fields, because logs can reintroduce the identity that the transport layer was intended to hide.

How to publish and retrieve the gateway key

Use the RFC 9540 discovery convention

RFC 9540, published in March 2024, defines the ohttp service-binding indication and a default well-known gateway resource at /.well-known/ohttp-gateway. A client can retrieve the key configuration with a GET request that includes Accept: application/ohttp-keys. A successful response uses the application/ohttp-keys media type.

GET /.well-known/ohttp-gateway HTTP/1.1
Host: gateway.example
Accept: application/ohttp-keys

The response carries the gateway’s key identifier and HPKE algorithm information needed to encrypt an OHTTP request. Protect this response with HTTPS and an integrity and authentication mechanism that lets the client attribute the configuration to the intended gateway. A client should reject an unauthenticated or altered configuration.

Handle redirects without creating a client identifier

A gateway may redirect the well-known request to another resource. The client must not pass a client-specific redirected URI to the relay as the gateway destination. A unique URI can become an identifying value visible to the relay or other observers. Normalize discovery to the gateway resource identity selected by policy rather than forwarding a per-client redirect target.

Reduce exposure during key retrieval

If the client fetches keys directly from the gateway, that fetch can reveal identifiers such as the client IP address. Fetching through an HTTP proxy can hide the address from the gateway. Clients can also apply consistency checks so that a gateway does not issue a unique key configuration that partitions one client from the rest of an anonymity set. Those mitigations do not remove the need to authenticate the configuration.

Rotate keys deliberately

Publish overlapping valid configurations long enough for clients to refresh safely, and retain the private key needed to decrypt requests created with each still-valid public configuration. Coordinate expiry, cache lifetime, and relay deployment so that a relay is not forwarding requests encrypted to a key the gateway has already discarded. The exact rotation interval is an operational choice; RFC 9458 does not prescribe a universal number.

Build or choose the gateway

1. Implement RFC 9458 message handling. The gateway must accept the OHTTP encapsulated request format, perform HPKE decapsulation with the configured private key, and return an encapsulated response.
2. Expose discovery. Serve the well-known gateway resource and return the key configuration with the required media type and authentication protections.
3. Apply target authorization. Parse the inner request only after successful decapsulation, then compare its destination and operation with an explicit allowlist.
4. Forward or handle the request. Keep the application logic stateless where possible, and remove or normalize headers that are not needed by the target.
5. Encapsulate every response. Return the response through the OHTTP response format rather than sending a plaintext HTTP response to the relay.
6. Log safely. Avoid recording raw payloads or stable identifiers unless they are necessary, access-controlled, and covered by your privacy policy.

A concrete, non-normative implementation example is the thibmeu/ohttp-gateway repository. Its documented setup requires the OHTTP_KEY_SEED environment variable, serves GET /.well-known/ohttp-gateway for application/ohttp-keys, and provides POST endpoints for decapsulation and forwarding to a configured target URL. Its algorithms, paths, environment variables, and runtime choices are repository-specific examples, not requirements imposed on every OHTTP gateway.

Configure the relay

1. Assign one gateway. Configure the relay with the gateway resource identity it is authorized to serve. Keep this mapping explicit rather than accepting a destination from each request.
2. Require HTTPS from clients. The client-to-relay connection must provide confidentiality and integrity.
3. Require HTTPS to the gateway. The relay-to-gateway connection must also be encrypted. This prevents a network observer on that leg from correlating or modifying traffic through simple inspection.
4. Forward the encapsulated body unchanged. The relay should preserve the OHTTP bytes and the protocol headers required by the gateway. It should not decompress, parse, or rewrite the encrypted payload.
5. Strip unknown and identifying fields. Remove headers that are not required for forwarding and avoid adding Via, Forwarded, client IP headers, unique tracing IDs, or equivalent metadata.
6. Limit operational data. Keep access logs to the minimum needed for reliability and abuse prevention, and set retention and access controls that match the privacy goal.

A generic HTTP intermediary can be used as a relay only if it is configured with these privacy properties. A conventional reverse proxy that automatically appends client-identifying headers or routes arbitrary hosts is not an OHTTP relay in the required sense.

Configure the client

1. Set the relay URI. This is the HTTPS endpoint to which the client will POST the encapsulated request.
2. Set the gateway resource identity. Use the stable gateway identity selected by your service policy, not a client-specific redirect URI.
3. Obtain and authenticate the key configuration. Fetch the RFC 9540 resource or receive the configuration through another authenticated channel. Verify that the key belongs to the intended gateway and that its algorithms are supported.
4. Construct a request that can stand alone. Include only the fields needed for the operation. Do not depend on a relay-maintained cookie or an unencrypted session between calls.
5. Encode and encrypt. Serialize the request as Binary HTTP and encrypt it with HPKE using the selected key identifier.
6. POST to the relay over HTTPS. Send the encapsulated message to the configured relay and reject responses that do not match the expected OHTTP response format.
7. Decrypt and validate. Use the corresponding HPKE context to recover the response, then apply application-level validation, status handling, and limits.

The client does not authenticate the target resource through OHTTP. RFC 9458 requires a way to authorize the gateway for use with the target, but the protocol itself does not prove to the client that a particular target generated the returned content. Treat the gateway as an authorized intermediary and use application-level response validation when the result is security-sensitive.

Test the complete path before sending sensitive data

1. Start with a non-sensitive target. Use a test endpoint that returns a known response and contains no personal information.
2. Verify discovery. Confirm that the well-known request succeeds, the response has the expected application/ohttp-keys type, and the key configuration passes authentication and consistency checks.
3. Check encryption boundaries. Inspect relay logs and packet captures at the relay boundary to ensure the application request is not visible there. Do the same on the relay-to-gateway path.
4. Confirm byte preservation. Verify that the relay forwards the encapsulated body without rewriting, decompression, or truncation.
5. Test target policy failures. Send a request for a destination outside the allowlist and confirm that the gateway rejects it without making an outbound connection.
6. Test malformed and oversized messages. Confirm bounded memory use, clear error handling, and no plaintext leakage in errors or logs.
7. Exercise key rotation. Introduce a new configuration while the old one remains valid, then retire the old key only after clients and relays have converged.
8. Check metadata. Ensure that no client IP, Forwarded, Via, unique request token, or equivalent identifier is added by the relay.

Privacy limits and failure modes

Identifiers inside the request remain visible

Encryption protects the request while it crosses the relay, but the gateway can read all decrypted fields. Scrub names, email addresses, cookies, credentials, and stable device or account identifiers unless the operation genuinely requires them.

Requests can still be correlated

Repeated or distinctive request content can link activity. Active key configurations can partition clients into smaller anonymity sets, and traffic analysis based on timing, volume, and encrypted length is outside the protection OHTTP claims to provide. OHTTP therefore reduces a specific network identity leak; it does not guarantee anonymity against every observer.

Stateful applications may fail

Applications that require a sequence of authenticated requests, server-side sessions, or browser cookies need a different design. Consider independent, privacy-preserving tokens or a stateless API operation instead of trying to hide a conventional session inside OHTTP.

Relay and gateway collusion defeats separation

If the same organization can freely join relay logs with gateway logs, the principal privacy benefit is weakened. Separate operators, minimize retained metadata, and define governance and access controls that prevent routine cross-correlation.

Key retrieval exposes the client

Direct key retrieval can reveal the client IP to the gateway. Use a proxy or a trusted distribution channel where that exposure matters, and check configurations for unexpected uniqueness.

Self-hosted and managed relay choices

The right deployment depends on the threat model and operational capacity, not on a universally best provider. Compare the options against the following criteria.

Cloudflare’s documented model has a customer-operated application gateway/backend, client-side OHTTP support, and a connection to its relay. In that description, the gateway decrypts and forwards inner requests, encrypts responses, and advertises public key configuration; the client encrypts requests, sends them through the relay, decrypts responses, and obtains the gateway key configuration. The service is described as enterprise-only and in closed beta as of October 2, 2026, not as a generally available public relay.

Operations checklist

• Document the client, relay, gateway, and target identities separately.
• Use HTTPS on both the client-to-relay and relay-to-gateway connections.
• Authenticate and integrity-protect gateway key configuration.
• Keep relay and gateway administration independent when unlinkability is required.
• Use an explicit gateway target allowlist.
• Strip unknown, identifying, and automatically injected forwarding headers.
• Keep user-identifying content out of inner requests unless necessary.
• Plan key rotation, overlap, expiry, and cache behavior together.
• Limit logs and review crash-reporting paths for accidental payload capture.
• Monitor rejection rates, key-age errors, malformed messages, latency, and relay-to-gateway failures without creating new client identifiers.

Troubleshoot common setup problems

The client cannot obtain a key configuration

Check the HTTPS certificate, the exact /.well-known/ohttp-gateway path, the Accept: application/ohttp-keys request header, and the response media type. Then verify authentication, clock assumptions, cache behavior, and whether a redirect produced a client-specific URI.

The relay returns an immediate protocol error

Confirm that the client is POSTing the encapsulated OHTTP message to the relay endpoint, that the relay is mapped to the intended gateway, and that no intermediary is decompressing or rewriting the body. Compare the bytes received by the relay with those sent to the gateway.

The gateway cannot decrypt

Check that the client selected a currently valid key identifier and supported algorithms, that the corresponding private key is loaded, and that rotation did not retire the key too early. A repository-specific deployment may also require an environment variable such as OHTTP_KEY_SEED; do not assume that variable exists in other implementations.

The request reaches an unintended destination

Stop forwarding, inspect target parsing and redirects, and enforce the allowlist before any outbound connection. The gateway should fail closed when the destination, method, or path is not authorized.

Privacy review finds a client identifier

Inspect relay-added headers, trace IDs, access logs, error bodies, and application fields inside the decrypted request. Remove or pseudonymize unnecessary values, and check whether direct key retrieval is exposing the client address.

The Bottom Line

An OHTTP deployment is a coordinated three-party system, not a switch you can add to an ordinary web server. Build an authenticated gateway key-discovery path, bind each relay to an allowlisted gateway, use HTTPS on both legs, keep relay and gateway administration separate, and design requests without unnecessary identity or session state. Test the encrypted path and metadata behavior before using real user data.

Quick Recap

Bestseller No. 1

WatchGuard Firebox M295 High Availability Unit with 3 Year Standard Support - HA Device for Failover, Requires Matching Primary - Not a Standalone Device - Rackmount Firewall (WGM295000+WGM2951603)

$2,185.11

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.