Why does this proxy require authentication when used from curl but not from python requests?

Question

I'm using https://github.com/abhinavsingh/proxy.py , setting it up with basic auth like so:

proxy --basic-auth "user:pass"

When I use it with curl, it requires proxy auth as expected:

curl -I -x localhost:8899 http://example.com  => 407
curl -I -x user:pass@localhost:8899 http://example.com => 200

But when I use it from Python, I can access it without providing any auth:

import requests

proxies = {
  "http": "http://127.0.0.1:8899",
  "https": "http://127.0.0.1:8899"
}


response = requests.get("https://www.example.com", proxies=proxies)

print(response.status_code) 

I get a 200. Am I missing something?

Answer 1

This looks like a bug in proxy.py . It appears to be triggered by the fact that requests makes an HTTP/1.0 request with no request headers. You can trigger the same issue yourself:

$ telnet localhost 8899
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
CONNECT www.example.com:80 HTTP/1.0

HTTP/1.1 200 Connection established

Unlike requests , curl always sends request headers, even when using --proxy1.0 , so it's not possible to trigger the same behavior.