Secure proxy credentials: environment variables, URL encoding and logs

Separate entry, credentials and destination

The proxy host and port identify the entry; the username and password authenticate your connection; the destination URL identifies the service you visit. Keep all location and session parameters from the generated configuration intact.

An http:// proxy entry and an https:// destination describe different connections. HTTPS at the destination does not automatically encrypt the client-to-HTTP-proxy authentication step. Assess transport protection on untrusted networks and use a supported configuration.

Python: encode each credential component

When a proxy URL is required, encode username and password separately if they contain characters such as @, : or %. Read secrets from the runtime environment instead of committing them. Environment variables still need access controls and must not be printed or uploaded.

import os
from urllib.parse import quote
import requests

user = quote(os.environ["PROXY_USER"], safe="")
password = quote(os.environ["PROXY_PASSWORD"], safe="")
proxy = f"http://{user}:{password}@PROXY_HOST:PORT"
with requests.Session() as session:
    session.trust_env = False
    response = session.get("https://example.com/",
        proxies={"http": proxy, "https": proxy}, timeout=(8, 25))
    response.raise_for_status()
    print("HTTP", response.status_code)

Replace PROXY_HOST:PORT with the entry from your dashboard. trust_env = False disables environment-derived proxy and other settings; assess it first if you rely on environment certificate settings.

curl: keep passwords out of the command

curl --proxy "http://PROXY_HOST:PORT" \
  --proxy-user "YOUR_USERNAME" --noproxy "" \
  --connect-timeout 8 --max-time 25 https://example.com/

With no password supplied, curl prompts interactively. Do not paste full proxy strings into shared shell history, screenshots, tickets or CI output. Debug traces can contain Proxy-Authorization, cookies and URLs; remove sensitive values before sharing.

Respond to exposed credentials

1. Stop using exposed credentials and reset them using the product’s supported process or contact support.
2. Update affected applications and retire the old configuration.
3. Review access and traffic anomalies; clean up logs and shared files you control.
4. Set access and secret-handling procedures for each use, and keep credentials out of repositories.

For authentication failures, see proxy troubleshooting and share only redacted information.