Basic and Digest Proxy Authentication
Choose a proxy authentication method supported by both ends, and distinguish a Digest challenge from encrypted transport.
Read the proxy's Proxy-Authenticate challenge before forcing Basic or Digest. The client must support a method the service offers; selecting Digest cannot add it to a Basic-only proxy.
For an endpoint that supports Digest, curl can use:
curl --proxy http://proxy.example:3128 --proxy-digest --proxy-user alice --connect-timeout 5 --max-time 15 https://example.com/Use the real endpoint and account. A username without a password lets curl prompt. For Basic, choose --proxy-basic; origin-server authentication uses different options. Check the running curl build's support as well as the challenge.
| Method | Credential exchange | Protection to assess |
|---|---|---|
| Basic | An encoded username/password pair. | The encoding is not encryption. |
| Digest | A challenge-derived response. | Algorithms, challenge parameters and client implementation determine protection; request/response content remains unencrypted by the method. |
Both still need suitable client-to-proxy transport. Destination HTTPS starts too late to protect an earlier cleartext proxy login.
On the server, Digest helpers can require realm-specific credential material and their own format. A Basic NCSA file is not automatically a Digest backend. Use the selected helper's documented format, then check missing credentials, wrong credentials and an authorized request while keeping source/destination restrictions in force.