Observed behaviour
Every HTTPS request through an NTLM-authenticated proxy costs three round-trips:
- Unauthenticated CONNECT → 407
- CONNECT + NTLM Type 1 → 407 + Type 2 challenge
- CONNECT + NTLM Type 3 → 200
Step 1 can be redundant on every connection after the first attempt — IF the proxy's auth requirement doesn't change between requests.
Root cause
connectViaProxy() in proxy.go unconditionally fires an unauthenticated RoundTrip before checking for a 407.
There is no mechanism to remember that a given proxy host has previously demanded authentication.
Impact/ROI
Not a bug, but a feature request for users where they are hitting a known host/proxy which requires Auth, to eliminate one round-trip per CONNECT tunnel after warm-up, reducing latency and proxy log noise. This is particularly noticeable when a tool makes frequent short-lived HTTPS requests to the same endpoint. eg Claude Code (multiple sessions + multiple agents) hitting the same inference endpoint via a corporate mandated proxy.
Proposed Options
@samuong, wanted your thoughts on this, before looking at implementing a fix, in case there were any other paths, you may have in mind already or if you don't feel this feature is desired.
Option 1 - In memory cache
Add a per-session cache (keyed on proxy host) that stores the auth schemes advertised in the first 407 response.
On subsequent CONNECT tunnels to the same host, skip the unauthenticated probe and call retryConnectWithAuth directly with the cached schemes. The NTLM Type 1/2/3 handshake is unchanged.
- Cache is only populated on a 407 — proxies that don't require auth are never cached and continue to receive the
unauthenticated probe
- RFC 7235 §4.3 explicitly permits this: "usually, but not necessarily, after receiving a 407"
- The cache is conservative: it requires observed evidence (a prior 407 from that host in this session) before skipping the probe
Option 2 - Static host list
Static host list via env var — user declares known-auth proxy hosts upfront, skipping the probe from the first connection.
This follows the same pattern as the existing ALPACA_PROXY_AUTH_ALLOWLIST.
In connectViaProxy, if the proxy host is in the list, skip the unauthenticated probe and call retryConnectWithAuth directly with a default scheme set (["Negotiate", "NTLM", "Basic"]) — auth.pick() intersects that with what's actually configured anyway.
- Simpler code, follows existing ALPACA_PROXY_AUTH_ALLOWLIST pattern, but requires user configuration.
Observed behaviour
Every HTTPS request through an NTLM-authenticated proxy costs three round-trips:
Step 1 can be redundant on every connection after the first attempt — IF the proxy's auth requirement doesn't change between requests.
Root cause
connectViaProxy() in proxy.go unconditionally fires an unauthenticated RoundTrip before checking for a 407.
There is no mechanism to remember that a given proxy host has previously demanded authentication.
Impact/ROI
Not a bug, but a feature request for users where they are hitting a known host/proxy which requires Auth, to eliminate one round-trip per CONNECT tunnel after warm-up, reducing latency and proxy log noise. This is particularly noticeable when a tool makes frequent short-lived HTTPS requests to the same endpoint. eg Claude Code (multiple sessions + multiple agents) hitting the same inference endpoint via a corporate mandated proxy.
Proposed Options
@samuong, wanted your thoughts on this, before looking at implementing a fix, in case there were any other paths, you may have in mind already or if you don't feel this feature is desired.
Option 1 - In memory cache
Add a per-session cache (keyed on proxy host) that stores the auth schemes advertised in the first 407 response.
On subsequent CONNECT tunnels to the same host, skip the unauthenticated probe and call retryConnectWithAuth directly with the cached schemes. The NTLM Type 1/2/3 handshake is unchanged.
unauthenticated probe
Option 2 - Static host list
Static host list via env var — user declares known-auth proxy hosts upfront, skipping the probe from the first connection.
This follows the same pattern as the existing ALPACA_PROXY_AUTH_ALLOWLIST.
In connectViaProxy, if the proxy host is in the list, skip the unauthenticated probe and call retryConnectWithAuth directly with a default scheme set (["Negotiate", "NTLM", "Basic"]) — auth.pick() intersects that with what's actually configured anyway.