Comment 0 for bug 244448

Common practice to use bzr 1.5 with proxy is to specify proxy settings in environment variable HTTP_PROXY. It is ok for most systems, but quite unnatural for windows. Even if config files are not the best place to store passwords (esp. domain credentials that are often used to authenticate against windows proxies), exposing them in environment variable is like writing them on a wall.

To store credentials more or less securely I propose entering "proxy_server", "proxy_user" and "proxy_pwd" configuration variables explicitly in [DEFAULT] section of some global and into branch/project specific sections of configuration files. Current authentication.conf file description is confusing and file format is itself bogus in the sense that it still needs HTTP_PROXY variable to supply user/pass for it. I doubt that it works at all, at least for my installation modifying [proxy] settings doesn't affect anything with or without HTTP_PROXY set (windows 2000).

Windows proxy options processing should take into account that some special combination of username and password (possibly empty) can be used to allow SSPI magic authenticate against proxy transparently. See bug #244435