Honor system proxy credentials in Apache transport
Added route-scoped HTTP and HTTPS system credential fallback for proxy challenges while preserving explicit Resolver authentication precedence and redirect isolation.
apache/maven-resolver · #2148
Proxy authentication correctness fix
Apache transport now honors matching system proxy credentials under the existing opt-in without exposing them to repository-origin authentication.
Problem
When aether.connector.http.useSystemProperties was enabled, Apache transport used system proxy hosts and ports but ignored proxyUser and proxyPassword. Authenticated proxies therefore returned HTTP 407 even though the matching credentials were configured.
Approach
Introduces a proxy authentication strategy that selects credentials only when the configured proxy host and effective port match the active route. Explicit Resolver proxy authentication remains authoritative, HTTP and HTTPS properties follow the target protocol with a controlled fallback, and redirect processing clears system-derived state when the proxy changes or the route becomes direct.
Impact and scope
- Allows Resolver 2.x transfers through dynamically configured authenticated system proxies without requiring a generated settings.xml entry.
- Keeps proxy credentials scoped to proxy authentication and prevents them from being offered to repository origins.
- Preserves explicit Resolver credentials, default proxy ports, and the existing disabled-by-default system-properties opt-in.
- Adds no public API or runtime dependency; the related Resolver 1.9.x lineage requires its separate backport and is not claimed by this merge.
Validation
- The native regression reproduced HTTP 407 on unchanged master before the runtime fix.
- Nineteen new cases cover GET, HEAD, PUT, HTTPS CONNECT, explicit-credential precedence, missing or mismatched properties, default ports, origin isolation, and proxy-changing or direct redirects.
- The full 31-module verification passed 2,082 tests with no failures or errors, and the integration profile passed 107 integration tests plus one Invoker build.
- The hosted matrix passed across Linux, Windows, and macOS with JDK 21, 25, and 26 against Maven 3.10.0-rc-1 and 4.0.0-rc-6. An Apache Maven Resolver member approved the final revision, and the verified merge commit credits Goutam Adwant.