Module auth 

HTTP Basic authentication (RFC 7617) for CONNECT requests.

Which header

Surge sends credentials on every CONNECT request, but its manual does not say in which field — Proxy-Authorization is the proxy-semantics answer and what comparable implementations use, while Authorization is what a client that treats the proxy as an origin would send. This is the one point the research left open (decision D3), so both are accepted: every value of Proxy-Authorization is tried first, then every value of Authorization, and any one of them matching is enough. When the first live Surge connection settles the question, nothing here needs to change.

Two values is all that answers for, so MAX_CREDENTIAL_VALUES is the most one request may carry and a request carrying more is refused with 400 before any of them is tried. Every value that is tried and refused is charged one authentication failure, so a request cannot buy more guesses than it pays for (decision D76, addendum of 2026-09-04).

Comparison discipline

Username and password are compared with subtle::ConstantTimeEq, and the loop over configured users deliberately does not stop at the first match, so neither the position of the matching user nor the length of a matching prefix is observable in the response time. What does remain observable is the length of the configured secrets: ct_eq reports a mismatch immediately when two slices differ in length. Credentials live in the config file as plaintext, so there is no way around that short of hashing them, and a length oracle on a password is not a meaningful attack.

Comparison is on raw bytes rather than decoded text, so it is independent of whether the client encoded the credentials as UTF-8 or ISO-8859-1 (RFC 7617 §2.1 leaves that partly open).

Structs

Authenticator

Checks request credentials against the configured users.

Denials

Every refusal one request’s credentials drew, in the order they were tried.

Enums

Denied

Why a request’s credentials were not accepted.

Constants

CHALLENGE

The challenge offered when credentials are missing or wrong.

MAX_CREDENTIAL_VALUES

The most credential field values one request may carry.

Functions

challenge_fields

The Proxy-Authenticate field a 407 response carries.

credential_values

How many credential field values a request carries, across both names.