cmd/go: try next proxy if dial proxy failed #32253
Comments
|
My personal preference is not to try the next proxy if the first proxy fails or isn't reachable - so the user knows the failure situation and chooses to explicitly opt out to the next proxy or gets alerted. If we fallback to the next proxy silently in case the first proxy fails to responds, it can lead to unexpected leakage of private module paths. There could be other security implication but I will let @FiloSottile chime in. |
|
I can see a pretty bad scenario like Since GONOSUMDB is not scoped per proxy, this would let the fallback proxy provide arbitrary answers for company.internal/foo if http://proxy.internal is unreachable. That's pretty much unacceptable. |
|
#31913 (comment) also applies to this failure mode. (We know that the current proxy behavior is not ideal for users in China, but that's tracked separately in #31755.) |
|
Duplicate of #31913 |
if we got dial error when using the proxy lists, we should try next proxy. Now only 404 and 410 will try next proxy.
We can wrap dial op error as a
no exist errorto implement it.As default lists
https://proxy.golang.org,direct, if some users can't accesshttps://proxy.golang.org, they will fall back todirect, maybe we should custom thetimeoutpara, maybe not./cc @rsc @bcmills
The text was updated successfully, but these errors were encountered: