An @ in a Java Proxy Password
Pass a raw password to PasswordAuthentication and apply URL encoding only when constructing an actual proxy URL.
java.net.PasswordAuthentication receives a username and a password character array. Pass the original password characters:
var credential = new java.net.PasswordAuthentication(
"proxy-user", "p@ssword".toCharArray());The value is an illustrative password. In application code, obtain the real characters from the intended credential source.
An @ inside this password is data, because the password already has its own argument. Converting it to p%40ssword before the constructor supplies a different password.
A proxy URL has another credential representation. In a URL such as http://proxy-user:p%[email protected]:8080, the encoded @ belongs inside user information, while the later @ separates that information from the host. Decode and encode according to the interface that actually consumes the value.
Shell quoting, Java string-literal escaping and URL percent-encoding also solve different parsing problems. Determine which layer is reading the input instead of repeatedly encoding the credential until a request changes behavior.