{"record":{"id":"909be2bb841c6a18","repo":"nodejs/node","slug":"proxy-authorization-should-be-sent-in-proxyagent-c","errorCode":null,"errorMessage":"Proxy-Authorization should be sent in ProxyAgent constructor","messagePattern":"Proxy-Authorization should be sent in ProxyAgent constructor","errorType":"exception","errorClass":"InvalidArgumentError","httpStatus":null,"severity":"error","filePath":"deps/undici/src/lib/dispatcher/proxy-agent.js","lineNumber":375,"sourceCode":" */\nfunction throwIfProxyAuthIsSent (headers) {\n  for (const key in headers) {\n    if (isProxyAuthorizationHeader(key)) {\n      throwProxyAuthError()\n    }\n  }\n}\n\n/**\n * @param {string} key\n * @returns {boolean}\n */\nfunction isProxyAuthorizationHeader (key) {\n  return key.length === proxyAuthorization.length && key.toLowerCase() === proxyAuthorization\n}\n\nfunction throwProxyAuthError () {\n  throw new InvalidArgumentError('Proxy-Authorization should be sent in ProxyAgent constructor')\n}\n\nmodule.exports = ProxyAgent\n","sourceCodeStart":357,"sourceCodeEnd":379,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/undici/src/lib/dispatcher/proxy-agent.js#L357-L379","documentation":"Thrown by throwIfProxyAuthIsSent when a 'proxy-authorization' header is found in the per-request headers passed to ProxyAgent.dispatch. For security, Proxy-Authorization must be supplied once at construction (via auth/token/url credentials) so it is not leaked or overridden per request; the per-request check (added to fix a security vulnerability) blocks the older pattern. The check is case-insensitive on the header key and is scheduled for removal in the next major version for performance.","triggerScenarios":"Calling proxyAgent.dispatch({ ..., headers: { 'proxy-authorization': 'Basic ...' } }) or any case variant like 'Proxy-Authorization'. The dispatch path routes headers through throwIfProxyAuthIsSent, which iterates keys and matches via isProxyAuthorizationHeader.","commonSituations":"Migrating from code that set Proxy-Authorization per request; HTTP libraries that auto-attach proxy auth headers from env; merging upstream request headers that include a proxy-authorization copied from elsewhere.","solutions":["Remove any 'proxy-authorization' header from per-request headers.","Move the credential to ProxyAgent construction via opts.token, opts.auth, or the proxy URL's user info.","Strip proxy-authorization in a header-sanitizing middleware before dispatch.","If a library auto-injects it, configure that library to stop doing so for proxied requests."],"exampleFix":"// before\nproxyAgent.dispatch({ ..., headers: { 'proxy-authorization': `Basic ${b64}` } })\n// after\nnew ProxyAgent({ uri, token: `Basic ${b64}` })\nproxyAgent.dispatch({ ..., headers: {} })","handlingStrategy":"validation","validationCode":"function stripProxyAuth(headers = {}) {\n  const out = {}\n  for (const [k, v] of Object.entries(headers)) {\n    if (k.toLowerCase() !== 'proxy-authorization') out[k] = v\n  }\n  return out\n}\nproxyAgent.dispatch({ ..., headers: stripProxyAuth(reqHeaders) })","typeGuard":"function hasProxyAuthHeader(headers = {}) {\n  return Object.keys(headers).some(k => k.toLowerCase() === 'proxy-authorization')\n}","tryCatchPattern":"try {\n  proxyAgent.dispatch(req)\n} catch (e) {\n  if (e.code === 'UND_ERR_INVALID_ARG' && /Proxy-Authorization/.test(e.message)) {\n    delete req.headers['proxy-authorization']\n    proxyAgent.dispatch(req)\n  } else throw e\n}","preventionTips":["Set Proxy-Authorization only at ProxyAgent construction.","Sanitize outbound headers to drop proxy-authorization before dispatch.","Disable auto-injection of proxy auth headers in upstream HTTP libraries."],"tags":["undici","proxy","proxy-agent","security","headers","invalid-arg"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}