Select Java HTTP Proxy Credentials from the Challenge Identity

Match requestor type, host and port before returning an account; keep unrelated server challenges outside that lookup.

For each HTTP authentication callback, make the credential decision in this order:

  1. Check that the requestor is the proxy rather than the destination server.
  2. Match the requesting host and port to an approved proxy entry.
  3. Return that entry's account, or no credentials for an unmatched challenge.

A single unconditional username/password cannot express two proxies' accounts and can leak them to another recipient.

Prefer a client-attached Authenticator when using Java's HTTP client builder. A JVM default Authenticator affects other participating code too.

Define any host-alias mapping deliberately instead of accepting arbitrary names. This is an HTTP pattern; SOCKS can use another implementation path even at a similar hostname.

For diagnosis, record challenge type and matched account identifier without its secret. That explains the scope decision without logging passwords.

Winndannde jowitiiɗe heen