Skip to content

[3.11] gh-158907: Do not send proxy credentials to a direct origin on 407 (#158956) - #161923

Open
orsenthil wants to merge 1 commit into
python:3.11from
orsenthil:backport-ab48ba8-3.11
Open

orsenthil wants to merge 1 commit into
python:3.11from
orsenthil:backport-ab48ba8-3.11

Conversation

@orsenthil

@orsenthil orsenthil commented Nov 13, 2026 •

Copy link
Copy Markdown
Member

ProxyBasicAuthHandler and ProxyDigestAuthHandler looked up passwords with the scheme-less origin host, so an HTTP 407 could match credentials stored for HTTPS and retry in cleartext.

…gin on 407 (python#158956)

ProxyBasicAuthHandler and ProxyDigestAuthHandler looked up passwords with the scheme-less origin host, so an HTTP 407 could match credentials stored for HTTPS and retry in cleartext.

---------

Co-authored-by: Senthil Kumaran <senthil@python.org>
(cherry picked from commit ab48ba8)
@python-cla-bot

Copy link
Copy Markdown

The following commit authors need to sign the Contributor License Agreement:

CLA not signed

@orsenthil

Copy link
Copy Markdown
Member Author

Per this - #158956 (comment) the CLA is signed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants