http: authentication failed, no Proxy-Authorization header

Operating system

Linux

System version

1.11.0

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.11.0-7f79458b

Environment: go1.23.3 linux/arm64
Tags: with_gvisor,with_wireguard,with_reality_server,with_clash_api,with_quic,with_utls,with_ech,with_v2ray_api,with_grpc
Revision: 7f79458b4f3dd4c2fed470e2a79e5619d6c70f7c
CGO: enabled

Description

like issue #1524
using sing-box as http proxy server.
when use Chrome, sometimes work, but sometimes got error as title.
when use PuTTY or FileZilla, always got error as title.
all above proxy client work fine with Squid.

If I modify handshake.go, add conn.Close() after call responseWith(), then Chrome/FileZilla will work.
But PuTTY still not working.

here are tcpdump log for sing-box and squid:
sing-box.log

squid.log

Reproduction

1. setup a http inbound in sing-box with user/password.
2. using Chrome/FileZilla/Putty to connect via above proxy

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by inspecting handshake.go around responseWith() and compare the attached sing-box.log and squid.log traces. Reproduce the HTTP inbound with user/password using Chrome, FileZilla, and PuTTY; done means these clients authenticate and connect through the proxy without the missing Proxy-Authorization failure or the proposed conn.Close() workaround.