{"id":"c1e3ebfdb3842305","repo":"aio-libs/aiohttp","slug":"reason","errorCode":null,"errorMessage":"{reason}","messagePattern":"\\{reason\\}","errorType":"http","errorClass":"ClientHttpProxyError","httpStatus":null,"severity":"error","filePath":"aiohttp/connector.py","lineNumber":1641,"sourceCode":"                # once the response is received and processed allowing\n                # START_TLS to work on the connection below.\n                protocol.set_response_params(\n                    read_until_eof=True,\n                    timeout_ceil_threshold=self._timeout_ceil_threshold,\n                )\n                resp = await proxy_resp.start(conn)\n            except BaseException:\n                proxy_resp.close()\n                conn.close()\n                raise\n            else:\n                conn._protocol = None\n                try:\n                    if resp.status != 200:\n                        message = resp.reason\n                        if message is None:\n                            message = HTTPStatus(resp.status).phrase\n                        raise ClientHttpProxyError(\n                            proxy_resp.request_info,\n                            resp.history,\n                            status=resp.status,\n                            message=message,\n                            headers=resp.headers,\n                        )\n                except BaseException:\n                    # It shouldn't be closed in `finally` because it's fed to\n                    # `loop.start_tls()` and the docs say not to touch it after\n                    # passing there.\n                    transport.close()\n                    raise\n\n                return await self._start_tls_connection(\n                    # Access the old transport for the last time before it's\n                    # closed and forgotten forever:\n                    transport,\n                    req=req,","sourceCodeStart":1623,"sourceCodeEnd":1659,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/connector.py#L1623-L1659","documentation":"Raised by _create_proxy_connection() when the proxy's response to the CONNECT request is not HTTP 200. aiohttp builds the message from resp.reason (or the standard HTTPStatus phrase for the code if reason is missing) and raises ClientHttpProxyError, a ClientResponseError carrying status, headers, and history. Non-200 from CONNECT typically means 407 (auth required / failed) or 403/502 (proxy policy).","triggerScenarios":"Proxy returned 407 Proxy Authentication Required (bad/missing Proxy-Authorization), 403 Forbidden, 502/503, or any non-200 status to the CONNECT establishing the tunnel.","commonSituations":"Proxy credentials missing or wrong. Proxy allowlist excludes the target host. Proxy rate-limiting. Squid/forward-proxy returning 407 on first request because auth header wasn't supplied. HTTP proxy that refuses CONNECT to certain ports.","solutions":["For 407: supply proxy auth via `aiohttp.BasicAuth` in the `proxy_headers=` argument or in the proxy URL (`http://user:pass@proxy:8080`).","Confirm the target host/port is allowed by the proxy's ACL.","Read `exc.status`, `exc.headers`, and the body for the proxy's reason text.","Switch to a proxy that permits CONNECT to the destination, or use a direct connection."],"exampleFix":"# before\nasync with session.get('https://target', proxy='http://proxy:8080') as r: ...\n# 407 Proxy Authentication Required\n# after\nimport aiohttp\nauth = aiohttp.BasicAuth('user', 'pass')\nasync with session.get(\n    'https://target',\n    proxy='http://proxy:8080',\n    proxy_headers={'Proxy-Authorization': auth.encode()},\n) as r: ...","handlingStrategy":"try-catch","validationCode":"import aiohttp\n\ndef proxy_auth_header(user: str, pw: str) -> dict:\n    return {'Proxy-Authorization': aiohttp.BasicAuth(user, pw).encode()}","typeGuard":null,"tryCatchPattern":"from aiohttp import ClientHttpProxyError\ntry:\n    await session.get(url, proxy=proxy_url, proxy_headers=proxy_auth_header(u, p))\nexcept ClientHttpProxyError as e:\n    if e.status == 407:\n        # refresh credentials and retry once\n        ...\n    raise","preventionTips":["Always supply Proxy-Authorization when the proxy requires auth; test against a known endpoint.","Read exc.status/headers/body to distinguish auth failures from policy failures.","Confirm the proxy allows CONNECT to the target host:port before relying on it."],"tags":["connector","proxy","http","authentication","client"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}