Netty client: proxy authentication not supported for HTTPS CONNECT tunnels, Proxy-Authorization leaks to origin #1569

Problem

The Netty client connector (NettyClientHelper) creates the CONNECT tunnel for HTTPS requests with new HttpProxyHandler(tunnelProxy), without credentials. When a proxy requires authentication, it answers 407 Proxy Authentication Required and the tunnel fails.

HeaderUtils.addGeneralHeaders also adds Proxy-Authorization (from Request.getProxyChallengeResponse()) to the request headers whatever the proxy mode. For HTTPS these headers travel inside the TLS tunnel, so the proxy credentials are sent to the origin server instead of the proxy.

Plain HTTP through a forward proxy is not affected, because there the request headers do go to the proxy.

Proposed fix

• When tunneling, take the proxy credentials from the request's proxy challenge response (or from new proxyUsername / proxyPassword connector parameters) and pass them to HttpProxyHandler(address, username, password) for Basic auth.
• Leave Proxy-Authorization out of requests sent through a CONNECT tunnel.
• Note that tunnel connections are pooled per origin, so credentials need to be part of the pool key (or be connector-level only).
• Extend ProxyTestCase with an authenticating test proxy, and assert that the origin never receives Proxy-Authorization.