net/http: Transport doesn't support NTLM challenge authentication #20053
Description
Please answer these questions before submitting your issue. Thanks!
What version of Go are you using (go version)?
Go 1.8
What operating system and processor architecture are you using (go env)?
OSX darwin-amd64
What did you do?
I have send an https request to a proxy (ntlm) below request and initial response
(via wireshark)
Request:
CONNECT www.endpoint.com:443 HTTP/1.1
Host: www.endpoint.com:443
User-Agent: Go-http-client/1.1
Location: https://www.endpoint.com
Proxy-Authorization: NTLM TlRMTVNTUAABAAAAB4IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAAAAMAA=
------------------------------------------------------------------------------------------
Response
HTTP/1.1 407 Proxy Authentication Required
Server: FreeProxy/4.50
Date: Thu, 20 Apr 2017 15:20:10 GMT
Content-Type: text/html
Transfer-Encoding: Chunked
Proxy-Authenticate: NTLM
TlRMTVNTUAACAAAADAAMADgAAAAFgoECloLVra5EaVAAAAAAAAAAA
A9KAEYAUgBPAEcAMAACAAwASgBGAFIATwBHADAAAQAOAFcASQBOA
ZgByAG8AZwAuAGwAbwBjAGEAbAADACYAdwBpAG4AMgAwADEAMgAu
wAbwBjAGEAbAAFABYAagBmAHIAbwBnAC4AbABvAGMAYQBsAAcACAD
Proxy-Connection: Keep-Alive
------------------------------------------------------------------------------------------------
The response above never reach the client, on transport.dialConn the response return status code 407 for challenge , because the response code != 200 the persist connection become nil
-------------------------------------------------------------------------------------------
br := bufio.NewReader(conn)
resp, err := ReadResponse(br, connectReq) // resp.StatusCode =407
if err != nil {
conn.Close()
return nil, err
}
if resp.StatusCode != 200 {
f := strings.SplitN(resp.Status, " ", 2)
conn.Close()
return nil, errors.New(f[1]) // persist connection become nil
}
since the persist connection return nil then request is cancelled and response return as nil
with error Proxy Authentication Required
see --> transport.RoundTrip
--------------------------------------------------------------------------------------------
pconn, err := t.getConn(treq, cm) // pconn = nil
if err != nil {
t.setReqCanceler(req, nil)
req.closeBody()
return nil, err
}
-------------------------------------------------------------------------------------------------
What did you expect to see?
I expect the response to return is it send from the proxy with status code 407
What did you see instead?
I got nil response with error: Proxy Authentication Required
Note: if I use http instead of https it works OK
This issue is blocking us from developing support to NTLM Proxy , as requests https endpoint do not return challenge from proxy