Choosing Between @nuxtjs/proxy and a Custom Axios HTTPS Agent for Consistent TLS Validation in Nuxt 3

The Short Answer

No, @nuxtjs/proxy cannot be made to use an Axios httpsAgent. These two tools operate on different layers of the Node.js network stack: the proxy module uses http-proxy (which interacts directly with Node's http and https modules), while Axios is a high-level library with its own agent management. To achieve consistent TLS validation and DNS resolution, you must configure both independently using their respective options.

Likely Explanation and Technical Constraints

The disconnect exists because @nuxtjs/proxy is designed as a middleware for request forwarding. It intercepts an incoming request and pipes it to a target server. Axios, conversely, is a client used to initiate new requests. Because http-proxy does not utilize the Axios library to perform its forwarding, any httpsAgent passed to an Axios instance is invisible to the proxy.

DNS resolution further complicates this. Axios allows for a custom lookup function within its agent, whereas @nuxtjs/proxy relies on the Node.js runtime's default dns.lookup behavior unless the target is defined as an IP address.

Implementation Steps for Consistency

To ensure both paths handle TLS and DNS identically, apply the following mirrored configurations:

1. Configure the Proxy

In your nuxt.config.ts, use the https option within the proxy configuration to override TLS validation (e.g., for self-signed certificates in development):

export default defineNuxtConfig({
  proxy: {
    options: {
      target: 'https://api.example.com',
      changeOrigin: true,
      https: { 
        rejectUnauthorized: false // Matches Axios agent behavior
      }
    }
  }
})

2. Configure the Axios Instance

Create a centralized Axios instance (or a Nuxt plugin) that uses a matching https.Agent:

import axios from 'axios';
import https from 'https';

const apiClient = axios.create({
  httpsAgent: new https.Agent({
    rejectUnauthorized: false // Must match the proxy config
  })
});

Trade-offs and Recommended Patterns

Strategy	Pros	Cons
Exclusive Proxying	Centralized TLS/DNS config; hides API origins from client.	Increased server overhead; loss of Axios-specific interceptors for those calls.
Duplicated Config	Full control over client-side request lifecycle.	Maintenance burden; risk of configuration drift between proxy and client.

Recommended Pattern: If your goal is absolute consistency, route all outbound API calls through the proxy. By treating the proxy as the sole gateway for external traffic, you eliminate the need to manage httpsAgent settings in your application code entirely, as the Node.js server handles the TLS handshake at the proxy level.

Diagnostic Detail Needed: Are you using a custom DNS resolver (like a corporate internal DNS) that requires a specific lookup function, or are you primarily concerned with rejectUnauthorized settings for SSL certificates?