Parse Proxy-Authorization in a Go Forward Proxy

In a Go forward proxy, r.BasicAuth reads Authorization, which belongs to the destination website’s login. The proxy’s own credentials arrive in Proxy-Authorization.

A small adapter can reuse the public parser without changing the original request:

func proxyBasicAuth(r *http.Request) (string, string, bool) {
    headers := make(http.Header)
    headers.Set("Authorization", r.Header.Get("Proxy-Authorization"))
    return (&http.Request{Header: headers}).BasicAuth()
}

This fragment uses net/http. It returns parsed values and a parse-success flag; it does not authenticate the account. Pass the result to the proxy’s intended credential validator.

If authentication fails, return 407 with an appropriate Proxy-Authenticate challenge and stop processing that request. Authenticate before opening a destination connection or accepting a CONNECT tunnel.

After accepting credentials, consume the proxy’s own Proxy-Authorization header before ordinary forwarding. Preserve the original Authorization field for the origin. An upstream parent proxy, if present, needs its own deliberate authentication arrangement rather than receiving this client credential by accident.