This Proxy-Connection header seemed to be leaking to the target url in case of https as the request is tunneled through the proxy with CONNECT. It's set separately in ssl_socket.rb for the actual CONNECT request, which the proxy sees, so I think it should be enough.