Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug] Chromium: launch({ proxy: { username, password } }) credentials are sent to a website's 401 Basic challenge

Aperta
  • Qualcosa non va?
#43,326 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@yury-s ci sta già lavorando.

Dal 14/10/2026.

  • #43342 di @yury-s — integrata

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
playwright, python, typescript
Ambito
backend, security

Direzione di ricerca

Start with CRBrowserContext and CRNetworkManager._onAuthRequired in the Chromium backend, then trace authenticateProxyViaCredentials() and _shouldProvideCredentials(event.request.url); the issue says Firefox and WebKit may need the same check. Find or add coverage for a cached proxy authentication followed by a site's 401 Basic challenge. Done when proxy credentials answer proxy challenges only and are never sent to the site, while configured httpCredentials continue to follow their origin.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

v1.65

Version

  • Playwright 1.62.0 (Python, playwright package; same code in playwright-core coreBundle.js)
  • Chromium (bundled chromium_headless_shell-1234)
  • macOS 26.5 (should be platform independent)

Steps to reproduce

Fully local, self-contained script (no external network access): a Basic-auth HTTP proxy on 127.0.0.1 and a site that returns 401 WWW-Authenticate: Basic.

"""Minimal repro: Playwright launch proxy credentials are sent to a site's 401 Basic challenge.

Local only: a tiny HTTP proxy that requires Basic auth (127.0.0.1) and a site that answers 401 Basic.
"""
import asyncio
import base64
import threading
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

import urllib.request

from playwright.async_api import async_playwright

PROXY_USER, PROXY_PASS = "proxyuser", "proxy-secret-123"
SEEN = []


class Site(BaseHTTPRequestHandler):
    def do_GET(self):
        SEEN.append((self.path, self.headers.get("Authorization")))
        if self.path.startswith("/protected"):
            self.send_response(401)
            self.send_header("WWW-Authenticate", 'Basic realm="site"')
            self.end_headers()
            self.wfile.write(b"no")
            return
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"ok")

    def log_message(self, *a):
        pass


class Proxy(BaseHTTPRequestHandler):
    def do_GET(self):
        want = "Basic " + base64.b64encode(f"{PROXY_USER}:{PROXY_PASS}".encode()).decode()
        if self.headers.get("Proxy-Authorization") != want:
            self.send_response(407)
            self.send_header("Proxy-Authenticate", 'Basic realm="proxy"')
            self.end_headers()
            return
        headers = {k: v for k, v in self.headers.items() if k.lower() not in ("proxy-authorization", "proxy-connection")}
        req = urllib.request.Request(self.path.replace("site.test", "127.0.0.1"), headers=headers)
        try:
            resp = urllib.request.urlopen(req)
            status, body, rh = resp.status, resp.read(), resp.headers
        except urllib.error.HTTPError as e:
            status, body, rh = e.code, e.read(), e.headers
        self.send_response(status)
        for k, v in rh.items():
            if k.lower() not in ("transfer-encoding", "connection"):
                self.send_header(k, v)
        self.end_headers()
        self.wfile.write(body)

    def log_message(self, *a):
        pass


def serve(handler):
    srv = ThreadingHTTPServer(("127.0.0.1", 0), handler)
    threading.Thread(target=srv.serve_forever, daemon=True).start()
    return srv


async def main():
    site, proxy = serve(Site), serve(Proxy)
    site_url = f"http://site.test:{site.server_port}"
    async with async_playwright() as p:
        browser = await p.chromium.launch(
            proxy={"server": f"http://127.0.0.1:{proxy.server_port}", "username": PROXY_USER, "password": PROXY_PASS},
            args=["--proxy-bypass-list=<-loopback>"],
        )
        page = await browser.new_page()
        r1 = await page.goto(site_url + "/warm")          # proxy auth happens here (cache becomes warm)
        r2 = await page.goto(site_url + "/protected")     # site answers 401 Basic
        print("warm status", r1.status, "| protected status", r2.status)
        await browser.close()
    leaked = [a for path, a in SEEN if path.startswith("/protected") and a]
    for path, a in SEEN:
        print("site saw", path, "Authorization:", (base64.b64decode(a.split()[1]).decode() if a else None))
    print("LEAK" if any(PROXY_PASS in base64.b64decode(a.split()[1]).decode() for a in leaked) else "NO LEAK")


asyncio.run(main())

Run: pip install playwright && playwright install chromium && python repro.py

Expected

The proxy credentials are used only for the proxy's 407 Proxy-Authenticate challenge. A site's 401 WWW-Authenticate challenge should get no credentials (or only httpCredentials explicitly configured for that origin).

Actual

The site receives Authorization: Basic base64("proxyuser:proxy-secret-123"):

warm status 200 | protected status 401
site saw /warm Authorization: None
site saw /protected Authorization: None
site saw /protected Authorization: proxyuser:proxy-secret-123   <-- proxy credentials sent to the website

Cause (from reading the source)

  1. CRBrowserContext constructor calls authenticateProxyViaCredentials(), which copies the launch proxy credentials into this._options.httpCredentials = { username, password } with no origin, overwriting any user-supplied httpCredentials.
  2. CRNetworkManager._onAuthRequired(event) decides via _shouldProvideCredentials(event.request.url). Without an origin, that returns true for every request, so it answers Fetch.authRequired with ProvideCredentials regardless of event.authChallenge.source ("Proxy" vs "Server").

On a cold cache the single per-request attempt is consumed by the proxy's 407, so the site's 401 gets CancelAuth; once the proxy auth is cached, the site's 401 gets the proxy credentials.

Things tried

  • new_context(http_credentials={..., "origin": <proxy origin>}) together with launch proxy credentials: overwritten by step 1, still leaks.
  • Proxy credentials only via http_credentials with proxy origin (no launch credentials): the origin is compared against the request URL (the site), so the proxy's 407 is not answered.
  • extra_http_headers={"Proxy-Authorization": ...}: for HTTPS this ends up inside the tunnel and is sent to the site, which is worse.

Suggested fix

Keep proxy credentials separate from httpCredentials, and in _onAuthRequired use event.authChallenge.source: answer "Proxy" challenges only with the proxy credentials and "Server" challenges only with httpCredentials (subject to its origin). Firefox/WebKit backends may need the same check.

Security note

Any website the automated browser visits can obtain the proxy credentials by returning 401 Basic. For authenticated corporate/residential proxies this exposes the proxy account.

Lingua principale
TypeScript
Stelle
97.4k
Fork
6.6k
Merge medio
18h 53m
PR unite (30g)
307

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/playwright

Tutte le issue di microsoft/playwright

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.