OkHttp Basic Proxy Authentication: Stop Rejected Retries

For an HTTP proxy offering Basic authentication, OkHttp's proxyAuthenticator can return a request carrying credentials. Return null after an authorization attempt has already been rejected, rather than send the same answer again:

.proxyAuthenticator { _, response ->
    if (response.request.header("Proxy-Authorization") != null) {
        null
    } else {
        response.request.newBuilder()
            .header("Proxy-Authorization",
                    Credentials.basic(proxyUser, proxyPassword))
            .build()
    }
}

This sketch uses account values from the application's secret configuration. The guard permits an initial attempt and stops a repeated one. It implements Basic, not every scheme a proxy might advertise; inspect the challenge before choosing that response.

If the final result remains 407, compare the selected proxy, advertised scheme and documented account identity. A rejected password, an unsupported method and an incorrect username form need different corrections. Keep those observations and the final status in redacted diagnostics.

CONNECT has another callback context: OkHttp documents a synthetic preemptive proxy-authentication challenge before opening the tunnel. Handle that context according to the API rather than assuming each callback represents an ordinary destination response.

The separate authenticator is for destination-server authentication. Keep its credentials separate from the proxy login; a generic interceptor placing a proxy password on every outgoing request can send it at the wrong scope.

Historical reports also describe implementation bugs, including rejected proxy-response body handling. Record the OkHttp version and final exchange before assigning a present failure to an old report. The retry decision should still stop an unchanged credential attempt that has no useful new answer.