Enforce authentication
heydryft opened this issue · comments
Yeah, as proxy-authorization headers ain't requested from the client, they ain't being sent and therefore the username and password comes as null.
I'm currently requiring them manually on prepareRequestFunction,
if (!request.headers['proxy-authorization']) {
request.socket.write([
'HTTP/1.1 407 Proxy Authentication Required',
'Proxy-Authenticate: Basic realm="proxy"',
'Proxy-Connection: close',
].join('\r\n'))
request.socket.end('\r\n\r\n') // empty body
return
}
Would love to see this fixed.
Thanks!
Isn't this a standard and expected behavior? The client needs to send proxy-authorization
header, and if not, they get an error.
Most extensions, browsers, don't send by default. Even the most famous extension on chrome for proxies, SwitchyOmega requires a proxy-authenticate header with status code 407 (Proxy Authentication Required).
But this is exactly what is done - see https://github.com/apify/proxy-chain/blob/master/src/server.js#L401
Please can you be more specific what is the problem? What is the current behavior?
Currently, proxy-chain server doesn't send a 407 Proxy Authentication Required status code when proxy-authorization header ain't present.
If you set requestAuthentication: true
in your implementation of prepareRequestFunction()
, then the server will send the Proxy-Authenticate
header back to client. You're fully in control of this behavior.
But afaik upstream doesn't work with requestAuthentication: true
Closing this for now, as it's not a bug