Originally published on proxymint.

Set a Puppeteer proxy with --proxy-server or per browser context, authenticate with page.authenticate, fix 407 and SOCKS5 errors, and rotate by context.

TL;DR

  • Puppeteer takes a proxy per browser or per context. The --proxy-server launch flag covers the whole browser, and createBrowserContext({ proxyServer }) gives one isolated context its own exit inside the same browser.
  • Credentials go through page.authenticate, never the flag. Chrome does not use credentials embedded in proxy settings, and a user:pass@ URL in --proxy-server fails with net::ERR_NO_SUPPORTED_PROXIES.
  • A missing authenticate call looks like a network error. Current Chrome reports net::ERR_INVALID_AUTH_CREDENTIALS on HTTP pages and net::ERR_TUNNEL_CONNECTION_FAILED on HTTPS pages, not a 407 status.
  • SOCKS5 with a password does not work in Chrome. Chrome supports no SOCKSv5 authentication methods, so a password-protected SOCKS5 server fails with net::ERR_SOCKS_CONNECTION_FAILED whatever page.authenticate says.
  • Chrome allows 32 simultaneous connections through an HTTP/1.1 proxy. Heavy parallel work in one browser queues inside Chrome before the proxy sees it.

Key takeaways

  • Call page.authenticate on every page before goto. Cached credentials can make a forgotten call pass in testing and fail on a fresh context in production.
  • Give each identity its own context. Rotate by closing the context and opening the next on a fresh sticky session, so the IP, cookies and cache change together.
  • Use the HTTP endpoint when SOCKS5 needs a password. HTTPS pages still run end to end through the CONNECT tunnel.
  • Check the exit before the job runs. Assert the country inside the page, and set Accept-Language for the market whose pages the job reads.
  • Block images, fonts and media before sizing the plan. Request interception works alongside page.authenticate and cuts the bytes a per-GB tier bills.

Read the full guide on proxymint, with the commands, tables and sources.