Splunk SOAR HTTP Connector 4.0.1 Does Not Honor Proxy Environment Variables

Applicability

Description

Using Splunk SOAR with the HTTP Connector app may observe failed HTTP actions or failed Test Connectivity results after upgrading the HTTP Connector app to version 4.0.1.

This behavior can affect environments that rely on proxy environment variables, such as HTTP_PROXY, HTTPS_PROXY, http_proxy, or https_proxy, for outbound access. In affected versions, the connector bypasses those environment variables and attempts a direct connection to the destination. As a result, a DNS lookup from the SOAR host may be required even when the intended network path is through a proxy.

Typical impact includes failed SOAR playbook automations that use the HTTP Connector to access external or otherwise non-resolvable destinations.

Investigation

Confirm the following:

1. The affected asset uses the HTTP Connector app version 4.0.1.
2. The Splunk SOAR deployment relies on proxy environment variables for outbound HTTP/HTTPS access.
3. HTTP Connector actions or Test Connectivity fail when the destination cannot be resolved directly by the SOAR host.
4. Other proxy-aware utilities or integrations on the same SOAR host, such as curl, can access the destination successfully through the proxy.
5. If practical, test with HTTP Connector version 3.7.9 or another known-good earlier version. In the reported scenario, version 3.7.9 successfully used the proxy and did not require direct DNS resolution of the destination.

The issue was identified as a regression in HTTP Connector 4.0.1. The connector code set the Python Requests session option trust_env to False, preventing the session from using proxy settings supplied through environment variables.

Resolution

Upgrade the Splunk SOAR HTTP Connector app to version 4.0.3 or later.

HTTP Connector version 4.0.3 restores support for proxy environment variables and resolves the proxy/DNS behavior observed with version 4.0.1.

After upgrading:

1. Verify the required proxy environment variables are configured for the Splunk SOAR environment.
2. Run Test Connectivity for the HTTP Connector asset.
3. Run a representative HTTP Connector action or playbook to confirm that traffic succeeds through the proxy.
4. Maintain the current app version unless a later version is required for other fixes or features.

If an immediate upgrade is not possible, use HTTP Connector version 3.7.9 as a temporary workaround, provided it is compatible with the deployed Splunk SOAR version and has been validated in the environment.

Related Links

Link to SOAR HTTP Connector Splunkbase page