proxy-authenticate support

[w2l0o5]

Hackney just support basic proxy-authenticate, but this is not enough. We know that many corporation proxy server do NTLM or Kerberos or Negotiate proxy authenticate, rather than basic authenticate.
So maybe you can consider add a option {proxy-auth-type}, selectivily make a request header.

Header = [{<<"Proxy-Authorization">>, <<ProxyAuthType/binary, Credentials/binary>>}]

Or can implement automatically proxy authenticate, but that would be quite complicated. ;)
This is just my personal thoughts!

[benoitc]

mmm good idea!

I think it implies to find the right way to handle the different way to negociate with the proxy, so a proxy can be just a backend. WIll have a look

[benoitc]

Complexity Analysis

NTLM and Kerberos are challenge-response authentication protocols that are significantly more complex than Basic auth:

NTLM Authentication Flow

1. Client sends initial CONNECT request
2. Proxy responds with 407 Proxy Authentication Required + Proxy-Authenticate: NTLM
3. Client sends NTLM Type 1 (Negotiate) message
4. Proxy responds with NTLM Type 2 (Challenge) message containing server challenge
5. Client computes NTLM Type 3 (Authenticate) response using password hash + challenge
6. Proxy validates and establishes connection

This requires:

• Multiple round-trips (not single-shot like Basic)
• DES, MD4, MD5 cryptographic operations
• NTLM message encoding/decoding
• Session security negotiation

Kerberos/Negotiate

Even more complex - requires interaction with Key Distribution Center (KDC), ticket management, and often OS-level integration.

---

Proposed Solution: proxy_auth_fun Callback

Instead of implementing these protocols directly, we can add a callback option that lets users plug in custom authentication logic:

AuthFun = fun(ProxyHost, StatusCode, Headers) ->
    %% Called when proxy returns 407
    %% Return: {ok, AuthHeader} | {error, Reason}
    case proplists:get_value(<<"Proxy-Authenticate">>, Headers) of
        <<"NTLM", _/binary>> ->
            %% User implements NTLM using external library
            {ok, compute_ntlm_auth(...)};
        _ ->
            {error, unsupported_auth}
    end
end,
Options = [{proxy_auth_fun, AuthFun}, ...]

This approach:

• Keeps hackney lightweight
• Allows users to implement any auth scheme they need
• Can integrate with OS-level auth libraries (like erlntlm, sspi bindings, etc.)

I'll implement this callback mechanism as a first step.