Select Java HTTP Proxy Credentials from the Challenge Identity
Match requestor type, host and port before returning an account; keep unrelated server challenges outside that lookup.
For each HTTP authentication callback, make the credential decision in this order:
- Check that the requestor is the proxy rather than the destination server.
- Match the requesting host and port to an approved proxy entry.
- Return that entry's account, or no credentials for an unmatched challenge.
A single unconditional username/password cannot express two proxies' accounts and can leak them to another recipient.
Prefer a client-attached Authenticator when using Java's HTTP client builder. A JVM default Authenticator affects other participating code too.
Define any host-alias mapping deliberately instead of accepting arbitrary names. This is an HTTP pattern; SOCKS can use another implementation path even at a similar hostname.
For diagnosis, record challenge type and matched account identifier without its secret. That explains the scope decision without logging passwords.