Testing Proxy Credentials: Request Success vs. Fresh Validation

A request succeeding through a proxy proves that operation was allowed. It may not prove the password was checked afresh: the destination can be exempt, or the connection already authenticated.

For an operation check, use your controlled endpoint with a known small response and an access policy the account should satisfy:

curl --proxy http://proxy.example:8080   --proxy-anyauth --proxy-user 'USER:PROXY_PASSWORD'   https://probe.example/status

The endpoint and account are placeholders. These are intermediary credentials, separate from any destination login.

Keep response stage and challenge together. A 407 may begin or continue negotiation, report unsupported methods or reject an account. A 403 can indicate policy refusal, and a later website error can follow successful proxy login.

For fresh account validation, use the operator's supported account check or authenticated-identity logs. On your own proxy, backend evidence can distinguish actual validation from an anonymously allowed request. During password changes, include the cache validation window when deciding whether the old credential should have stopped working. For Squid 6.13 Basic authentication, credentialsttl controls a validation-cache window.