Scope RestTemplate Proxy Credentials with HttpClient 5

A proxy login belongs to the transport’s credential provider. For Spring 6 with Apache HttpClient 5, scope that account to the intermediary:

var proxy = new org.apache.hc.core5.http.HttpHost(
    "http", "proxy.example", 8080);
var credentials = new org.apache.hc.client5.http.impl.auth
    .BasicCredentialsProvider();
credentials.setCredentials(
    new org.apache.hc.client5.http.auth.AuthScope(proxy),
    new org.apache.hc.client5.http.auth.UsernamePasswordCredentials(
        proxyUser, proxyPassword.toCharArray()));

var http = org.apache.hc.client5.http.impl.classic.HttpClients.custom()
    .setProxy(proxy)
    .setDefaultCredentialsProvider(credentials)
    .build();
var factory = new org.springframework.http.client
    .HttpComponentsClientHttpRequestFactory(http);
var rest = new org.springframework.web.client.RestTemplate(factory);

The application supplies the proxyUser and proxyPassword values and owns the HTTP client’s lifecycle. Reuse rest for the workload rather than constructing another default template at the call site.

AuthScope limits where this credential is eligible. The example supplies ordinary username/password credentials; the name BasicCredentialsProvider does not force every challenge to use the HTTP Basic scheme.

With an HTTPS destination, the transport can answer a proxy challenge during CONNECT, before the application’s encrypted HTTP request exists. A generic destination interceptor adding Proxy-Authorization is not equivalent to that negotiation.

Configure any destination account separately. If the proxy still rejects the request, retain its advertised authentication scheme and the effective host and port. A scoped credential for another endpoint will not match simply because the password is correct.