>From what I can tell the difference between the PASSTHRU and PASS is only that PASSTHRU do not add any injected credentials from external_acl, right?
Imho there is no need for more than two of these options. PASS -> WWW+Proxy authentication passed along as-is if present. external_acl auth added as basic Proxy-Auth if none present. PROXYPASS -> WWW+Proxy authentication passed along as-is. Proxy authentication converted to WWW authentication if WWW auth not present. If neither proxy of WWW authentication present then external_acl auth added as basic WWW auth (maybe this should have higher priority than proxy auth here...) If peer is an origin server then we should perhaps strip Proxy auth from the outgoing request. Could also do this by default in PROXYPASS to make the difference between the two more obvious, making the rules as follow: !originserver+PASS: Proxy & WWW auth passed along as-is. If not Proxy-auth present then add external acl auth credentials as basic proxy auth. originserver+PASS: WWW auth pased along as-is. Maybe external_acl credentials as well (priority?) originserver+nothing set: No auth passed along (not trusted). PROXYPASS: WWW-auth passed along as-is. If no WWW-auth present then convert either Proxy-Auth or external acl credentials to Basic WWW auth. Regards Henrik