Why Browser fetch Cannot Send Proxy-Authorization
Explain why webpage code cannot supply a browser proxy login by setting a forbidden request header.
Proxy-Authorization is a forbidden request header for ordinary browser scripts. Names beginning with Proxy- are reserved, so an AJAX or fetch call cannot use that header as an application-controlled proxy-login mechanism.
Changing CORS response headers does not grant permission to set a browser-controlled request header. Likewise, moving the value into another custom header does not teach the browser to authenticate to its outgoing proxy.
The browser's proxy configuration and supported authentication flow handle that login. If a server-side application makes the request instead, its own HTTP client has proxy options; browser header restrictions and server client APIs are separate interfaces.
Keep the proxy password out of webpage JavaScript. Even if a custom application endpoint accepts such a value, it has become application data visible to that client, rather than a privileged browser networking setting.