http: authentication failed, no Proxy-Authorization header

[twu2]

Operating system

Linux

System version

1.11.0

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.11.0-7f79458b

Environment: go1.23.3 linux/arm64
Tags: with_gvisor,with_wireguard,with_reality_server,with_clash_api,with_quic,with_utls,with_ech,with_v2ray_api,with_grpc
Revision: 7f79458b4f3dd4c2fed470e2a79e5619d6c70f7c
CGO: enabled

Description

like issue #1524
using sing-box as http proxy server.
when use Chrome, sometimes work, but sometimes got error as title.
when use PuTTY or FileZilla, always got error as title.
all above proxy client work fine with Squid.

If I modify handshake.go, add conn.Close() after call responseWith(), then Chrome/FileZilla will work.
But PuTTY still not working.

here are tcpdump log for sing-box and squid:
sing-box.log

squid.log

Reproduction

1. setup a http inbound in sing-box with user/password.
2. using Chrome/FileZilla/Putty to connect via above proxy

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

[twu2]

after some test, this patch make putty work.
http_proxy.patch

when return 407, http.Response need Body, and Close set to true, also close the connection after write.

sorry, the patch not always work....

[dyhkwong]

Unable to reproduce with Chrome. FileZilla uses PuTTY as its engine so it is the same issue. Any documentation or RFC about PuTTY's behavior?

[twu2]

finally, I make PuTTY work.
I create a PR for this.
SagerNet/sing#78

[dyhkwong]

I don't think RFC mentioned an HTTP proxy server with Basic authentication needs to have such behavior. Why is this considered an issue of proxy software (sing-box, mihomo, v2ray, etc.) rather than an issue of PuTTY?

[twu2]

Chrome with SwitchyOmega. create multiple profile with different proxy server, then switch between profile may cause no Proxy-Authorization header (without asking user/password).

FileZilla and PuTTY not working with HTTP CONNECT method when using sing-box.

All of them working fine with Squid for same condition, so I think it's issue in sing-box not in PuTTY or FileZilla.

And, after apply above patch, all of them work fine now.