[3.14] gh-53852 Proxy Auth failure to raise 407 instead of 401 (GH-160917) (#160920)

gh-53852 Proxy Auth failure to raise 407 instead of 401 (GH-160917)

Proxy Auth failure to raise 407 instead of 401

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/407
is the correct status code to raise for the Proxy Authentication.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/401
is the generic code that can be raised for unauthorized response.
(cherry picked from commit 2e1666f)

Co-authored-by: Senthil Kumaran <senthil@python.org>

Author: miss-islington

Lib/test/test_urllib2.py

@@ -1854,6 +1854,25 @@ def test_unsupported_auth_digest_handler(self):
         opener.add_handler(http_handler)
         self.assertRaises(ValueError, opener.open, "http://www.example.com")
 
+    def test_digest_auth_failure_code(self):
+        # gh-53852: a failed proxy digest auth must report 407, not 401.
+        headers = http.client.HTTPMessage()
+        for handler_class, auth_header, code in [
+                (urllib.request.HTTPDigestAuthHandler,
+                 'www-authenticate', 401),
+                (urllib.request.ProxyDigestAuthHandler,
+                 'proxy-authenticate', 407)]:
+            with self.subTest(handler=handler_class.__name__):
+                handler = handler_class()
+                handler.retried = 6
+                req = Request("http://www.example.com/")
+                with self.assertRaises(urllib.error.HTTPError) as cm:
+                    handler.http_error_auth_reqed(auth_header,
+                                                  "www.example.com",
+                                                  req, headers)
+                self.assertEqual(cm.exception.code, code)
+                cm.exception.close()
+
     def test_unsupported_auth_basic_handler(self):
         # While using BasicAuthHandler
         opener = OpenerDirector()

Lib/test/test_urllib2_localnet.py

@@ -368,12 +368,14 @@ def test_proxy_with_bad_password_raises_httperror(self):
         self.digest_auth_handler.set_qop("auth")
         with self.assertRaises(urllib.error.HTTPError) as cm:
             self.opener.open(self.URL)
+        self.assertEqual(cm.exception.code, 407)
         cm.exception.close()
 
     def test_proxy_with_no_password_raises_httperror(self):
         self.digest_auth_handler.set_qop("auth")
         with self.assertRaises(urllib.error.HTTPError) as cm:
             self.opener.open(self.URL)
+        self.assertEqual(cm.exception.code, 407)
         cm.exception.close()
 
     def test_proxy_qop_auth_works(self):

Lib/urllib/request.py

@@ -1091,7 +1091,11 @@ def http_error_auth_reqed(self, auth_header, host, req, headers):
             # prompting for the information. Crap. This isn't great
             # but it's better than the current 'repeat until recursion
             # depth exceeded' approach <wink>
-            raise HTTPError(req.full_url, 401, "digest auth failed",
+            if auth_header.lower() == 'proxy-authenticate':
+                code = 407
+            else:
+                code = 401
+            raise HTTPError(req.full_url, code, "digest auth failed",
                             headers, None)
         else:
             self.retried += 1

Misc/NEWS.d/next/Library/2026-10-28-12-00-00.gh-issue-53852.Pr0xy4.rst

@@ -0,0 +1,3 @@
+:class:`urllib.request.ProxyDigestAuthHandler` now raises
+:exc:`~urllib.error.HTTPError` with status code 407 (Proxy Authentication
+Required) instead of 401 when proxy authentication fails.