{"version":"2.1.238","anchor":"self-hosted-runner-can-mint-a-proxy-authorization-header-per","canonical_anchor":"self-hosted-runner-can-mint-a-proxy-authorization-header-per","heading":"Self-hosted runner can mint a Proxy-Authorization header per connection","tier":"use","area":"Self-Hosted Runner","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/self-hosted-runner-can-mint-a-proxy-authorization-header-per","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Self-hosted runner can mint a Proxy-Authorization header per connection\n\nThe self-hosted runner can generate a fresh proxy auth token for every outbound connection.\n\n**What**\n\nThe self-hosted runner can now authenticate to an outbound HTTP proxy with a token it generates fresh for every connection, via `--proxy-authorization-command` \/ `SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_COMMAND` or `--proxy-authorization-file` \/ `SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_FILE`. Set exactly one. It is off unless you set it, and the help text says it is not yet supported with the orchestrator subcommand.\n\n**Details**\n\n- With it set, the runner starts a small forwarding proxy on 127.0.0.1 that injects the header, then points HTTPS_PROXY\/HTTP_PROXY at itself for the runner and every session it spawns, clearing the other proxy variables. NO_PROXY is left alone.\n- The command is re-run, or the file re-read, for each new connection, so rotating tokens stay current. The value is never logged.\n- The real upstream proxy must be named by HTTPS_PROXY or HTTP_PROXY, and must be `http:\/\/` or `https:\/\/`. ALL_PROXY alone is rejected.\n- The listener is brought up before the runner registers; if it cannot start, the runner prints a `[runner:fatal]` line and exits with code 1.\n- Both new environment variables are stripped from the environment handed to child processes, alongside the existing pool and environment secrets. Configured runs report `self_hosted_egress_proxy_auth`.\n\n**Evidence**\n\n`SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_COMMAND`, `set only one of --proxy-authorization-command (SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_COMMAND) and --proxy-authorization-file (SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_FILE)`, `[runner:fatal] could not start the proxy-authorization listener: `\n\n- Area: Self-Hosted Runner\n- Names: `--proxy-authorization-command`, `--proxy-authorization-file`, `SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_COMMAND`, `SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_FILE`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 3\/5"}