-
-
Notifications
You must be signed in to change notification settings - Fork 9.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for digest authentication with an HTTP proxy #2526
Comments
@justintime32 Thanks for the feature request! It should be entirely possible to write a short authentication handler that does exactly what you need: a quick Google showed this as the top result. Because of the ease of adding such a thing yourself, and because it's relatively infrequently used, we don't believe there's much advantage in bringing Proxy Digest Auth into the core library. |
Hi @Lukasa, I actually started by writing an auth handler. The main issue I ran into was that it only works for non-SSL requests. SSL requests through a proxy are made through a CONNECT tunnel, and the CONNECT request must be authenticated. The auth handler appears to be unable to hook into the proxy tunnel creation step, and therefore SSL requests will always fail. Are there other ways to add this authentication without modifying the core? Maybe some more hooks around the proxy tunnel creation? |
Unfortunately, what you need is not possible with def _tunnel(self):
connect_str = "CONNECT %s:%d HTTP/1.0\r\n" % (self._tunnel_host,
self._tunnel_port)
connect_bytes = connect_str.encode("ascii")
self.send(connect_bytes)
for header, value in self._tunnel_headers.items():
header_str = "%s: %s\r\n" % (header, value)
header_bytes = header_str.encode("latin-1")
self.send(header_bytes)
self.send(b'\r\n')
response = self.response_class(self.sock, method=self._method)
(version, code, message) = response._read_status()
if code != 200:
self.close()
raise OSError("Tunnel connection failed: %d %s" % (code,
message.strip())) As you can see, there is no way to hook into a 407 response here. We can only do this by overriding the way the HTTP connection functions, which is something we do in urllib3: I recommend opening a feature request there. |
Currently, requests only supports HTTP basic authentication to a proxy. It would be very useful to support digest authentication with a proxy as well.
Additionally, there should be some way to signal that requests should not attempt to pass proxy credentials in plaintext before receiving the digest nonce from the proxy.
The text was updated successfully, but these errors were encountered: