Python urllib2 HTTPS 和代理 NTLM 身份验证
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1481398/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Python urllib2 HTTPS and proxy NTLM authentication
提问by Laurent Luce
urllib2 doesn't seem to support HTTPS with proxy authentication in general, even less with NTLM authentication. Anyone knows if there is a patch somewhere for HTTPS on proxy with NTLM authentication.
urllib2 似乎一般不支持 HTTPS 与代理身份验证，更不支持 NTLM 身份验证。任何人都知道在某处是否有使用 NTLM 身份验证的代理上的 HTTPS 补丁。
Regards,
问候，
Laurent
洛朗
采纳答案by lemonad
Late reply. Urllib2 does not support NTLM proxying but pycurldoes. Excerpt:
迟回复。Urllib2 不支持 NTLM 代理，但pycurl支持。摘抄：
self._connection = pycurl.Curl()
self._connection.setopt(pycurl.PROXY, PROXY_HOST)
self._connection.setopt(pycurl.PROXYPORT, PROXY_PORT)
self._connection.setopt(pycurl.PROXYUSERPWD,
"%s:%s" % (PROXY_USER, PROXY_PASS))
...
回答by ZZ Coder
http://code.google.com/p/python-ntlm/
http://code.google.com/p/python-ntlm/
I never tried with HTTPS but I think it should work.
我从未尝试过 HTTPS，但我认为它应该可以工作。
EDIT: If you are using SSL Tunneling, proxy authentication is a bad idea.
编辑：如果您使用 SSL 隧道，代理身份验证是一个坏主意。
Proxy using Basic Auth over HTTPS is not secure when the SSL is tunneled. Your password will be sent in clear (Base64-encoded) to proxy. Lots of people assumes the password will be encrypted inside SSL. It's not true in this case.
当 SSL 通过隧道时，通过 HTTPS 使用基本身份验证的代理是不安全的。您的密码将以明文（Base64 编码）发送给代理。许多人认为密码将在 SSL 内加密。在这种情况下，事实并非如此。
It's almost impossible to support other encrypted or hashed mechanisms like Digest/NTLM because they all require negotiation (multiple exchanges) and that's not defined in CONNECT protocol. This negotiation happens out of the band of the HTTP connection. It's very hard to implement in proxy/browser also.
支持其他加密或散列机制（如 Digest/NTLM）几乎是不可能的，因为它们都需要协商（多次交换）并且在 CONNECT 协议中没有定义。这种协商发生在 HTTP 连接的带外。在代理/浏览器中也很难实现。
If this is an enterprise proxy, IP ACL is the only secure solution.
如果这是企业代理，IP ACL 是唯一的安全解决方案。
