Python urllib: Basic Proxy Authentication for HTTP Requests

Build an explicit urllib opener for a Basic HTTP proxy challenge, and distinguish that ordinary HTTP exchange from HTTPS CONNECT authentication.

For a Basic challenge from an HTTP proxy, use ProxyBasicAuthHandler. This ordinary HTTP example keeps the route and account in one opener:

import os
from urllib.request import (
    ProxyHandler, ProxyBasicAuthHandler,
    HTTPPasswordMgrWithDefaultRealm, build_opener,
)

proxy_url = 'http://proxy.example:8080'
passwords = HTTPPasswordMgrWithDefaultRealm()
passwords.add_password(
    None, proxy_url,
    os.environ['PROXY_USER'], os.environ['PROXY_PASSWORD'],
)
opener = build_opener(
    ProxyHandler({'http': proxy_url}),
    ProxyBasicAuthHandler(passwords),
)
with opener.open('http://example.com/', timeout=10) as response:
    print(response.status)

Use the real endpoint and operator-supplied account. The handler uses the password manager for the proxy's challenge; match the intended proxy URI and realm. Destination Basic authentication uses a different handler.

Calling the opener directly keeps this setup local. The request URL remains the website, not the intermediary. This cleartext HTTP route does not encrypt a Basic exchange.

Do not infer HTTPS tunnel support from this example. A 407 during CONNECT happens at setup, before an ordinary destination response; the selected integration must handle authentication there. Changing the website login handler cannot repair that earlier challenge.

Credential-bearing proxy URLs are another format found in older examples. If used, encode URL delimiters correctly and keep the resulting secret-bearing URL out of logs.

Аффингæй хæстæг статьялтæ