How to develop http proxy server with username and password authentication - http

Question

I want to write a http proxy with authentication in golang but I couldn't find any example.
Here is what I trid but didn't work: (I get Error parsing basic auth)
server := &http.Server{
Addr: "0.0.0.0:8080",
ReadTimeout: 15 * time.Second,
WriteTimeout: 15 * time.Second,
Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
b, err := httputil.DumpRequest(r, true)
if err == nil {
fmt.Println("dump", string(b))
} else {
fmt.Println("dump error", err)
}
u, p, ok := r.BasicAuth()
if !ok {
fmt.Println("Error parsing basic auth")
w.WriteHeader(401)
return
}
if u != "USERNAME"{
fmt.Printf("Username provided is correct: %s\n", u)
w.WriteHeader(401)
return
}
if p != "PASSWORD" {
fmt.Printf("Password provided is correct: %s\n", u)
w.WriteHeader(401)
return
}
if r.Method == http.MethodConnect {
handleTunneling(w, r)
} else {
handleHTTP(w, r)
}
}),
// Disable HTTP/2.
TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler)),
}
log.Fatal(server.ListenAndServe())
I tested the application with firefox and foxyproxy
enter image description here

Answer 1

HTTP Authentication has two headers for providing authentication information: Authorization and Proxy-Authorization.
Authorization header:
The "Authorization" header field allows a user agent to authenticate
itself with an origin server -- usually, but not necessarily, after
receiving a 401 (Unauthorized) response. Its value consists of
credentials containing the authentication information of the user
agent for the realm of the resource being requested.
Proxy-Authorization:
The "Proxy-Authorization" header field allows the client to identify
itself (or its user) to a proxy that requires authentication. Its
value consists of credentials containing the authentication
information of the client for the proxy and/or realm of the resource
being requested.
Request.BasicAuth() is for "Authorization" header, not for "Proxy-Authorization" header.
BasicAuth returns the username and password provided in the request's Authorization header, if the request uses HTTP Basic Authentication. See RFC 2617, Section 2.
For parsing "Proxy-Authorization" header you can copy parseBasicAuth() function from request.go.
func ProxyBasicAuth(header http.Header) (username, password string, ok bool) {
auth := header.Get("Proxy-Authorization")
if auth == "" {
return "", "", false
}
return parseBasicAuth(auth)
}
// parseBasicAuth parses an HTTP Basic Authentication string.
// "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true).
func parseBasicAuth(auth string) (username, password string, ok bool) {
const prefix = "Basic "
// Case insensitive prefix match. See Issue 22736.
if len(auth) < len(prefix) || !asciiEqualFold(auth[:len(prefix)], prefix) {
return "", "", false
}
c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
if err != nil {
return "", "", false
}
cs := string(c)
username, password, ok = strings.Cut(cs, ":")
if !ok {
return "", "", false
}
return username, password, true
}
// EqualFold is strings.EqualFold, ASCII only. It reports whether s and t
// are equal, ASCII-case-insensitively.
func asciiEqualFold(s, t string) bool {
if len(s) != len(t) {
return false
}
for i := 0; i < len(s); i++ {
if asciiLower(s[i]) != asciiLower(t[i]) {
return false
}
}
return true
}
// lower returns the ASCII lowercase version of b.
func asciiLower(b byte) byte {
if 'A' <= b && b <= 'Z' {
return b + ('a' - 'A')
}
return b
}
Here is the source code with minor changes. You can also check out packages like elazarl/goproxy and snail007/goproxy.