Network Access
R code that fetches data from the internet needs a proxy, and webRios runs one on your device. This page covers choosing between that and a public one, checking which a session is using, and what happens when the on-device one can’t start.
The setting lives in Settings → R Session → Network. For the mechanism and its limits, see How network access works.
Why there is a proxy at all
R compiled to WebAssembly has no sockets, so curl cannot open a connection on its own. The webR project solved this by turning those connections into WebSockets and tunnelling them through a SOCKS proxy. Somebody has to run that proxy. webRios runs one inside the app, so your requests go straight from your device to the site you asked for.
Choosing a route
| Setting | What happens |
|---|---|
| On-Device Only (default) | Requests go through the proxy inside the app. If it can’t start, curl requests are blocked and you are told. They are never rerouted. |
| On-Device, Public Fallback | The same, except that if the proxy can’t start, requests go through a public proxy hosted at r-universe.dev, and you are told. |
| Public Proxy | Every request goes through the public proxy. The on-device one is not started. |
This Session shows the route the running R session is actually using. Changing the setting does not move a session that is already running, so restart R to apply it. A Restart R to Apply button appears when the setting and the running session disagree.
A sample run
install.packages("curl")
library(curl)
r <- curl_fetch_memory("https://example.com")
r$status_code
#> [1] 200
Telling which route R is using
Settings shows it, and so does R. The proxy address is in ALL_PROXY:
sub(".*@", "", Sys.getenv("ALL_PROXY"))
#> [1] "127.0.0.1:52341"Strip everything up to the @ before printing it. The on-device address carries a credential that is regenerated every launch, and there is no reason to put it on screen or in a saved script.
| What you see | Route |
|---|---|
127.0.0.1:<port> |
The on-device proxy |
ws.r-universe.dev:443 |
The public proxy |
on-device-proxy-unavailable://… |
Blocked. curl requests fail immediately |
ALL_PROXY is set when the curl package first loads, so it reads empty in a session that has not used it yet.
Using the public proxy
The public proxy is the one the WebAssembly build of curl uses on its own, outside webRios. It is a shared service with publicly known credentials, and it is not run by us. It can see your device’s IP address and which sites you connect to. It cannot read the contents of https requests, because R negotiates that encryption with the site itself. R also contacts r-universe.dev to find the proxy when the session starts, before you make any request of your own.
A session on the public proxy reports the r-universe address:
When the on-device proxy can’t start
You are told once per launch, and the alert offers to allow the public proxy instead.
Until you do, curl requests fail immediately, naming the reason:
This affects httr2, and readr, vroom or xml2 when they read from a URL, because those packages switch to curl once it is installed. Installing packages and download.file() keep working, as the next section explains.
If you allow the fallback, R restarts and the session tells you it is on the public proxy:
What this setting does not cover
download.file(), url(), read.csv(url) and installing packages take a different route that no proxy setting touches. Those requests go straight from your device to the site named in your code, in every mode, including when curl is blocked. They are subject to the same cross-origin rules a web page has: see Network access from R.
The setting is a default rather than a sandbox. R code that sets its own proxy, for example with httr2::req_proxy(), overrides it.
For what each route means for your data, see the Privacy Policy.