Repository: dotnet/runtime
File: src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/AuthenticationHelper.cs (C#)

Code before:
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.Net.Http.Headers;
using System.Text;
using System.Threading;
using System.Threading.Tasks;

namespace System.Net.Http
{
    internal static partial class AuthenticationHelper
    {
        private const string BasicScheme = "Basic";
        private const string DigestScheme = "Digest";
        private const string NtlmScheme = "NTLM";
        private const string NegotiateScheme = "Negotiate";

        private const string EnableProactiveProxyAuthCtxSwitch = "System.Net.Http.EnableProactiveProxyAuth";
        private const string EnableProactiveProxyAuthEnvironmentVariable = "DOTNET_SYSTEM_NET_HTTP_ENABLEPROACTIVEPROXYAUTH";

        private static volatile int s_enableProactiveProxyAuth = -1;

        private static bool EnableProactiveProxyAuth
        {
            get
            {
                int enableProactiveProxyAuth = s_enableProactiveProxyAuth;
                if (enableProactiveProxyAuth != -1)
                {
                    return enableProactiveProxyAuth != 0;
                }

                // First check for the AppContext switch, giving it priority over the environment variable.
                if (AppContext.TryGetSwitch(EnableProactiveProxyAuthCtxSwitch, out bool value))
                {
                    s_enableProactiveProxyAuth = value ? 1 : 0;
                }
                else
                {
                    // AppContext switch wasn't used. Check the environment variable.
                    s_enableProactiveProxyAuth =
                        Environment.GetEnvironmentVariable(EnableProactiveProxyAuthEnvironmentVariable) is string envVar &&
                        (envVar == "1" || envVar.Equals("true", StringComparison.OrdinalIgnoreCase)) ? 1 : 0;

Review comment (security):
Nit: I'd call it `System.Net.Http.SocketsHttpHandler.ProxyPreAuthenticate`

Code after:
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.Net.Http.Headers;
using System.Text;
using System.Threading;
using System.Threading.Tasks;

namespace System.Net.Http
{
    internal static partial class AuthenticationHelper
    {
        private const string BasicScheme = "Basic";
        private const string DigestScheme = "Digest";
        private const string NtlmScheme = "NTLM";
        private const string NegotiateScheme = "Negotiate";

        private enum AuthenticationType
        {
            Basic,
            Digest,
            Ntlm,
            Negotiate
        }

        private readonly struct AuthenticationChallenge
        {
            public AuthenticationType AuthenticationType { get; }
            public string SchemeName { get; }
            public NetworkCredential Credential { get; }
            public string? ChallengeData { get; }

            public AuthenticationChallenge(AuthenticationType authenticationType, string schemeName, NetworkCredential credential, string? challenge)
            {
                AuthenticationType = authenticationType;
                SchemeName = schemeName;
                Credential = credential;
                ChallengeData = challenge;
            }
        }

        private static bool TryGetChallengeDataForScheme(string scheme, HttpHeaderValueCollection<AuthenticationHeaderValue> authenticationHeaderValues, out string? challengeData)
        {