[cloakbrowser] Could not normalize HTTP proxy URL, passing t

Error message

[cloakbrowser] Could not normalize HTTP proxy URL, passing through unchanged: ${(e as Error).message}

What it means

An unexpected exception was thrown while normalizing an HTTP proxy URL (typically invalid percent-encoding or characters that break encode/decode operations). The function logs the underlying error message and falls back to passing the partially normalized URL through unchanged.

Source

Thrown at js/src/proxy.ts:230

    if (encPass !== null) {
      userinfoPart = `${encUser}:${encPass}@`;
    } else if (encUser) {
      userinfoPart = `${encUser}@`;
    } else {
      userinfoPart = "";
    }
    const result = `${scheme}://${userinfoPart}${hostAndRest}`;
    const credsChanged = encUser !== rawUserEnc
      || (hasPassword ? encPass !== rawPassEnc : false);
    if (credsChanged) {
      console.info(
        "[cloakbrowser] Auto URL-encoded HTTP proxy credentials (special " +
        "characters detected). Pre-encode the URL to suppress this notice.",
      );
    }
    return result;
  } catch (e) {
    console.warn(`[cloakbrowser] Could not normalize HTTP proxy URL, passing through unchanged: ${(e as Error).message}`);
    return normalized;
  }
}

/**
 * Resolve proxy into Playwright option and/or Chrome args.
 *
 * Proxies with credentials (SOCKS5 or HTTP/HTTPS on supported platforms) are
 * passed via Chrome's --proxy-server flag with inline credentials, bypassing
 * Playwright's CDP auth interceptor which breaks on some proxies (#182).
 */
export function resolveProxyConfig(
  proxy: string | ProxyDict | undefined,
  browserVersion?: string,
  licenseKey?: string,
  releaseChannel?: string,
): ProxyConfig {
  if (!proxy) return { proxyArgs: [] };

View on GitHub (pinned to d6bad5de26)

Solutions

Percent-encode username and password individually with encodeURIComponent before building the URL.
Sanitize the value: trim whitespace and verify it parses with new URL(...).
If the provider gives a ready-encoded URL, use it verbatim instead of concatenating raw credentials.

Example fix

// before
const proxy = `http://user:pa#ss%zz@10.0.0.1:3128`;

// after
const proxy = `http://${encodeURIComponent('user')}:${encodeURIComponent('pa#ss%zz')}@10.0.0.1:3128`;

Defensive patterns

Strategy: validation

Validate before calling

function buildHttpProxy(user: string, pass: string, host: string, port: number): string {
  return `http://${encodeURIComponent(user)}:${encodeURIComponent(pass)}@${host}:${port}`;
}

Type guard

const hasValidPercentEncoding = (u: string): boolean => { try { decodeURIComponent(u); return true; } catch { return false; } };

Prevention

Encode username/password components at construction time.
Never paste raw credentials with @ : % # / into a proxy URL string.
Keep proxy config in one builder function so encoding happens in exactly one place.

When it happens

Trigger: Passing an http:// proxy string with invalid escape sequences (%ZZ), raw control characters, or other malformed structure into resolveProxy/resolveProxyConfig; the catch block returns the input unchanged.

Common situations: Proxy credentials copied with special characters ($, #, %, @) not encoded; environment variables with trailing newlines; URLs that were already double-encoded and break decodeURIComponent.

Related errors

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/39328f9b262a84a9. Report an issue: GitHub.