net/http: inconsistent HTTP/s_PROXY precedence

[maxcraig112]

Proposal Details

the golang net/http package has an inconsistency with other similar implementations that handles PROXY environment variable.

the uppercase version of the environment variable takes precedance over the lowercase version (source)

This is in contrast with other implementations

• curl: HTTP_PROXY (uppercase) is deliberately not accepted for HTTP; only http_proxy is read. HTTPS_PROXY/https_proxy both work with lowercase preferred.
• Python (urllib): checks both but lowercase takes priority; HTTP_PROXY is also silently ignored in CGI environments.
• Python (requests): delegates to urllib, inheriting the same lowercase-first behaviour.
• Rust (Cargo): HTTP_PROXY (uppercase) is explicitly excluded; only http_proxy, https_proxy, and HTTPS_PROXY are accepted, with lowercase taking precedence.

This can have unexpected behaviours when individuals expect when overriding existing ENV variables with the lowercase env var (it will not be overridden)

There is a worry that modifying this could cause an issue due to Hyrum's Law, however I believe moving away from the uppercase version (even potentially removing HTTP_PROXY due to HTTPOXY) would be beneficial in the long run

[gabyhelp]

Related Issues

• net/http: ProxyFromEnvironment doesn't support "https_proxy" environmental variables #6181 (closed)
• x/net/http/httproxy: Never uses proxy for localhost #28866
• net/http, x/net/http/httpproxy: http_proxy is being used for https requests #40909 (closed)
• net/http: provide ProxyFromEnvironment functionality without requiring environment #22079 (closed)
• x/net/http/httpproxy: document proxy authentication support #61505 (closed)
• net/http: considering supporting CIDR notation in no_proxy env variable #16704 (closed)
• net/http: document that ProxyFromEnvironment special-cases localhost #7256 (closed)
• net/http: do not query HTTP_PROXY on every request #7020 (closed)

Related Code Changes

• net/http: should default to use proxy from environment

Related Discussions

• Why does net/http ProxyFromEnvironment refuse to proxy localhost requests?

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[nicholashusin]

Hyrum's law is definitely a concern here.

IMO, changing lowercase to be the prioritized env var with a release note is probably reasonable and safe enough? The idea being that it's unlikely for someone to define both http_proxy and HTTP_PROXY with different values.

Removing HTTP_PROXY, on the other hand, is more likely to cause breakage. #40909 from 2020 shows that some users do use HTTP_PROXY rather than http_proxy. The HTTPOXY problem is at least a non-issue for the standard library after #16405.

[nicholashusin]

I propose we just switch the uppercase / lowercase priority while keeping HTTP_PROXY since we're already ignoring it in CGI environments (probably for Go 1.28 since the tree is already frozen for 1.27). Thoughts?

CC: @neild

[gopherbot]

Change https://go.dev/cl/801700 mentions this issue: http/httpproxy: prioritize lowercase proxy environment variables