Re: HTTPS, proxy environment variables and non-CONNECT access

["Nicolas Mailhot" <[e-mail]>]

Le Mar 16 juillet 2013 11:52, Robert Collins a écrit :

>> 2. how do you send auth from the client to the proxy in a secure way
>> without it leaking them outside?
>
> I think you mean 'If the origin is an HTTPS origin which uses
> replayable (e.g. basic) auth, how do you prevent that leaking [vs e.g.
> how do you authenticate to the proxy itself].

No, I really meant "how do you prevent web site auth leaking proxy-side,
and proxy auth leaking web site-side, without assuming one of those auths
is worthless and can be shared or exposed non-encrypted in the name of
cutting corners". And that in a world where the only auth most web clients
will use reliably is basic auth.

-- 
Nicolas Mailhot