Skip to content

docs: document Basic-only proxy auth across both transports#133

Merged
OmarAlJarrah merged 1 commit into
mainfrom
docs/proxy-auth-consistency
Jun 17, 2026
Merged

docs: document Basic-only proxy auth across both transports#133
OmarAlJarrah merged 1 commit into
mainfrom
docs/proxy-auth-consistency

Conversation

@OmarAlJarrah

Copy link
Copy Markdown
Member

Problem

The proxy-authentication documentation contradicted itself across ProxyOptions and the two shipped transports:

  • ProxyOptions told callers the JDK transport "negotiates Basic or Digest" with the proxy.
  • The JDK transport's KDoc (and a runtime warning) steered Digest users to "use the OkHttp transport for Digest proxy auth."
  • The OkHttp transport's KDoc stated it only ever emits Basic.

At most one of those could be right, and a reader following the docs was sent in a circle.

Reality

Both shipped transports authenticate the proxy with Basic only:

  • The OkHttp proxyAuthenticator always responds with Credentials.basic(...) and a Proxy-Authorization: Basic … header. There is no Digest code path.
  • The JDK transport installs a java.net.Authenticator on java.net.http.HttpClient. The client's built-in handling of a registered authenticator covers the Basic scheme only; it does not drive Digest proxy auth through that hook.

Change

Reconcile all three KDoc blocks and the two runtime warning strings:

  • ProxyOptions now states that both transports do Basic-only proxy auth, and points Digest-proxy users at a caller-supplied client (a java.net.http.HttpClient / OkHttpClient with their own authenticator) passed through create(...).
  • The JDK transport KDoc records the Basic-only limitation explicitly and drops the circular "use the OkHttp transport for Digest" steer. The challenge-handler warning now points at the BYO-client path.
  • The OkHttp transport warning likewise points at a BYO OkHttpClient with a custom proxyAuthenticator instead of implying another shipped transport supports Digest.

A ProxyAuthenticator test pins that the JDK authenticator returns the raw credentials regardless of the advertised scheme, so the Basic-only behaviour is the JDK client's and a Digest-only proxy is not satisfied end-to-end.

No public API signatures change.

Closes #109

The proxy-auth documentation contradicted itself. ProxyOptions told
callers the JDK transport "negotiates Basic or Digest" with the proxy,
the JDK transport's KDoc steered Digest users to the OkHttp transport,
and the OkHttp transport's KDoc said it only ever emits Basic. At most
one of those could be right.

In reality both shipped transports authenticate the proxy with Basic
only. The OkHttp proxyAuthenticator always responds with
Credentials.basic(...). The JDK transport installs a java.net.Authenticator
on java.net.http.HttpClient, whose built-in handling of a registered
authenticator covers the Basic scheme only and does not drive Digest
proxy auth through that hook.

Reconcile all three KDoc blocks and the two runtime warning strings:

- ProxyOptions now states both transports do Basic-only proxy auth and
  points Digest-proxy users at a caller-supplied client (a
  java.net.http.HttpClient / OkHttpClient with their own authenticator)
  passed through create(...).
- The JDK transport KDoc records the Basic-only limitation explicitly and
  drops the "use the OkHttp transport for Digest" steer, which sent
  readers in a circle. The challenge-handler warning now points at the
  BYO-client path.
- The OkHttp transport warning likewise points at a BYO OkHttpClient with
  a custom proxyAuthenticator instead of implying another shipped
  transport supports Digest.

Add a ProxyAuthenticator test pinning that the JDK authenticator returns
the raw credentials regardless of the advertised scheme, so the Basic-only
behaviour is the JDK client's and a Digest-only proxy is not satisfied
end-to-end.

Closes #109
@OmarAlJarrah OmarAlJarrah changed the title Document Basic-only proxy auth across both transports docs: document Basic-only proxy auth across both transports Jun 17, 2026
@OmarAlJarrah OmarAlJarrah merged commit b16a0d5 into main Jun 17, 2026
1 check passed
@OmarAlJarrah OmarAlJarrah deleted the docs/proxy-auth-consistency branch June 17, 2026 01:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Proxy-auth documentation is internally inconsistent and overstates JDK transport capabilities

1 participant