urllib3 ProxyManager: Send Basic Credentials in proxy_headers

ProxyManager has a separate proxy_headers argument for headers sent to the intermediary. For a proxy accepting Basic authentication:

import urllib3

proxy_headers = urllib3.make_headers(
    proxy_basic_auth=f'{proxy_user}:{proxy_password}'
)
with urllib3.ProxyManager(
    'http://proxy.example:8080',
    proxy_headers=proxy_headers,
    timeout=urllib3.Timeout(connect=5, read=10),
) as http:
    response = http.request('GET', 'https://service.example/data')
    print(response.status)

For a plain HTTP destination, these headers travel with the forwarded request to the proxy. For an HTTPS destination using CONNECT, they belong to tunnel setup rather than each encrypted website request.

The ordinary headers argument describes destination request headers. This proxy authentication belongs to a different recipient. Putting the proxy's account there is not equivalent to configuring the earlier CONNECT exchange.

make_headers constructs the Basic header value. It does not negotiate NTLM, select a supported scheme automatically or prove that the proxy accepts that account.

A proxy with a TLS listener adds a separate proxy TLS context. The http:// endpoint above deliberately describes an ordinary HTTP listener carrying an HTTPS destination through a tunnel.