[3.14] gh-60299: Fix ProxyDigestAuthHandler credential lookup to use proxy authority (GH-160528) (#160915)

gh-60299: Fix ProxyDigestAuthHandler credential lookup to use proxy authority (GH-160528)

AbstractDigestAuthHandler.get_authorization() always looked up
credentials using the target request URL (req.full_url), even when
invoked via ProxyDigestAuthHandler, whose credentials are registered
against the proxy's host:port.

The lookup never matched, no Proxy-Authorization header was produced,
and proxy digest auth failed with an unhandled 407.
(cherry picked from commit 9b3e095)

Co-authored-by: Senthil Kumaran <senthil@python.org>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: 3 people

Lib/test/test_urllib2.py

@@ -1734,6 +1734,66 @@ def test_proxy_basic_auth(self):
                               "proxy.example.com:3128",
                               )
 
+    def test_proxy_digest_auth(self):
+        # gh-60299: ProxyDigestAuthHandler must look up credentials using
+        # the proxy's authority
+        opener = OpenerDirector()
+        ph = urllib.request.ProxyHandler(dict(http="proxy.example.com:3128"))
+        opener.add_handler(ph)
+        password_manager = MockPasswordManager()
+        digest_handler = urllib.request.ProxyDigestAuthHandler(password_manager)
+        realm = "ACME Networks"
+        http_handler = MockHTTPHandlerRedirect(
+            407,
+            'Proxy-Authenticate: Digest realm="%s", nonce="abcdef0123456789", '
+            'qop="auth"\r\n\r\n' % realm)
+        opener.add_handler(digest_handler)
+        opener.add_handler(http_handler)
+
+        user, password = "wile", "coyote"
+        request_url = "http://acme.example.com/protected"
+        proxy_authority = "proxy.example.com:3128"
+
+        digest_handler.add_password(realm, proxy_authority, user, password)
+        self.assertEqual(realm, password_manager.realm)
+        self.assertEqual(proxy_authority, password_manager.url)
+
+        opener.open(request_url)
+
+        self.assertEqual(password_manager.target_realm, realm)
+        self.assertEqual(password_manager.target_url, proxy_authority)
+
+        self.assertEqual(len(http_handler.requests), 2)
+        self.assertFalse(
+            http_handler.requests[0].has_header("Proxy-authorization"))
+        self.assertTrue(
+            http_handler.requests[1].has_header("Proxy-authorization"))
+        self.assertTrue(
+            http_handler.requests[1]
+            .get_header("Proxy-authorization").startswith("Digest "))
+
+    def test_digest_auth_uses_full_url(self):
+        # The non-proxy case must keep using the full request URL (not
+        # just the host) for the password lookup, so that sub-URI realm
+        # matching (HTTPPasswordMgr.is_suburi) keeps working
+        opener = OpenerDirector()
+        password_manager = MockPasswordManager()
+        digest_handler = urllib.request.HTTPDigestAuthHandler(password_manager)
+        realm = "ACME Networks"
+        request_url = "http://acme.example.com/protected"
+        http_handler = MockHTTPHandlerRedirect(
+            401,
+            'WWW-Authenticate: Digest realm="%s", nonce="abcdef0123456789", '
+            'qop="auth"\r\n\r\n' % realm)
+        opener.add_handler(digest_handler)
+        opener.add_handler(http_handler)
+
+        digest_handler.add_password(realm, request_url, "wile", "coyote")
+        opener.open(request_url)
+
+        self.assertEqual(password_manager.target_realm, realm)
+        self.assertEqual(password_manager.target_url, request_url)
+
     def test_basic_and_digest_auth_handlers(self):
         # HTTPDigestAuthHandler raised an exception if it couldn't handle a 40*
         # response (https://bugs.python.org/issue1479302), where it should instead

Lib/test/test_urllib2_localnet.py

@@ -351,6 +351,8 @@ def create_fake_proxy_handler(*args, **kwargs):
         self.server.start()
         self.server.ready.wait()
         proxy_url = "http://127.0.0.1:%d" % self.server.port
+        # Credentials must be registered against proxy authority
+        self.proxy_authority = "127.0.0.1:%d" % self.server.port
         handler = urllib.request.ProxyHandler({"http" : proxy_url})
         self.proxy_digest_handler = urllib.request.ProxyDigestAuthHandler()
         self.opener = urllib.request.build_opener(
@@ -361,7 +363,7 @@ def stop_server(self):
         self.server = None
 
     def test_proxy_with_bad_password_raises_httperror(self):
-        self.proxy_digest_handler.add_password(self.REALM, self.URL,
+        self.proxy_digest_handler.add_password(self.REALM, self.proxy_authority,
                                                self.USER, self.PASSWD+"bad")
         self.digest_auth_handler.set_qop("auth")
         with self.assertRaises(urllib.error.HTTPError) as cm:
@@ -375,15 +377,15 @@ def test_proxy_with_no_password_raises_httperror(self):
         cm.exception.close()
 
     def test_proxy_qop_auth_works(self):
-        self.proxy_digest_handler.add_password(self.REALM, self.URL,
+        self.proxy_digest_handler.add_password(self.REALM, self.proxy_authority,
                                                self.USER, self.PASSWD)
         self.digest_auth_handler.set_qop("auth")
         with self.opener.open(self.URL) as result:
             while result.read():
                 pass
 
     def test_proxy_qop_auth_int_works_or_throws_urlerror(self):
-        self.proxy_digest_handler.add_password(self.REALM, self.URL,
+        self.proxy_digest_handler.add_password(self.REALM, self.proxy_authority,
                                                self.USER, self.PASSWD)
         self.digest_auth_handler.set_qop("auth-int")
         try:

Lib/urllib/request.py

@@ -1142,7 +1142,13 @@ def get_authorization(self, req, chal):
         if H is None:
             return None
 
-        user, pw = self.passwd.find_user_password(realm, req.full_url)
+        # proxy auth is looked up by the proxy's authority
+        # req.host, set by Request.set_proxy()
+        if self.auth_header == 'Proxy-Authorization':
+            authority = req.host
+        else:
+            authority = req.full_url
+        user, pw = self.passwd.find_user_password(realm, authority)
         if user is None:
             return None
 

Misc/NEWS.d/next/Library/2026-10-23-21-52-40.gh-issue-60299.Af6IzL.rst

@@ -0,0 +1,4 @@
+Fix :class:`urllib.request.ProxyDigestAuthHandler` failing to authenticate. It
+looked up credentials using the target request URL instead of the proxy's
+authority, so passwords registered via ``add_password()`` against the proxy
+never matched. Patch by Senthil Kumaran.