Skip to content

The built-in SocketMode client fails to establish WS connections via proxy server #1169

@Lordshinjo

Description

@Lordshinjo

Reproducible in:

The Slack SDK version

slack-sdk==3.13.0

Python runtime version

3.6.13

OS info

ProductName:	macOS
ProductVersion:	11.6.3
BuildVersion:	20G415
Darwin Kernel Version 20.6.0: Wed Jan 12 22:22:45 PST 2022; root:xnu-7195.141.19~2/RELEASE_ARM64_T8101

Steps to reproduce:

  1. Pass an authenticated proxy url containing url-encoded characters (e.g. http://username:pass%2Fword@example.com) to a synchronous slack_sdk.socket_mode.SocketModeClient, either via HTTPS_PROXY env variable or proxy argument.
  2. Connect to the Slack API.

Expected result:

The connection through the proxy is successful.

Actual result:

The connection fails with the following error:

Traceback (most recent call last):
  File "[redacted]/lib/python3.6/site-packages/slack_sdk/socket_mode/builtin/connection.py", line 116, in connect
    trace_enabled=self.trace_enabled,
  File "[redacted]/lib/python3.6/site-packages/slack_sdk/socket_mode/builtin/internals.py", line 81, in _establish_new_socket_connection
    f"Failed to connect to the proxy (proxy: {proxy}, connect status code: {status})"
Exception: Failed to connect to the proxy (proxy: http://[redacted]:[redacted with url encoded chars]@[redacted url]:80, connect status code: 407)

The documentation for urllib.parse.urlparse mentions that % escapes are not expanded, and username and password should not be url-encoded when they are passed as part of a Basic authentication.

As far as I understand the issue is simply that the username and password should be url-decoded before being base64'd in the following code:

if parsed_proxy.username is not None and parsed_proxy.password is not None:
# In the case where the proxy is "http://{username}:{password}@{hostname}:{port}"
raw_value = f"{parsed_proxy.username}:{parsed_proxy.password}"
auth = b64encode(raw_value.encode("utf-8")).decode("ascii")
message.append(f"Proxy-Authorization: Basic {auth}")

(As a side note, printing the full proxy info including the password in the exception is not so great, but that's another issue.)

Metadata

Metadata

Assignees

Labels

Version: 3xbugM-T: A confirmed bug report. Issues are confirmed when the reproduction steps are documentedsocket-mode

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions