Keep Encoded Proxy Credentials Intact in a Batch File

A proxy URL works when configured directly, but authentication fails after the same value moves into a Windows batch file. Check whether the batch parser changed the percent signs before the HTTP client received the URL.

There are two separate representations. URL encoding can represent a backslash as %5C and a question mark as %3F. A literal percent sign in a batch-file command needs escaping as %%.

For an illustrative account domain\user with the placeholder password pass?, a .bat file can contain:

set "https_proxy=http://domain%%5Cuser:pass%%[email protected]:8080"

The process launched afterward should receive a URL containing domain%5Cuser:pass%3F. The doubled percent signs belong to the batch source, not to the proxy URL stored by the client.

Do not copy that batch spelling into an .npmrc file or an application's proxy field: those inputs do not go through the same batch parsing step. Likewise, this example is not PowerShell syntax. Another wrapper, such as CALL or a command constructed for a second shell, can introduce another parsing pass and needs its own review.

Quote the SET assignment as shown so incidental spaces or shell metacharacters do not become part of an unintended command. Quoting alone does not prevent percent expansion.

When checking the result, compare the expected encoding with a redacted representation rather than printing the password-bearing URL to a shared log. A shell-escaping repair preserves the credential; it does not select an authentication scheme the client did not already support.