407 behind the corporate VPN proxy: npm, Maven and VS Code

The browser's successful intranet page proves the proxy works for the browser, not for npm or Maven. Each client reads its own configuration, and a VPN-only network adds a second question: whether the client can reach the proxy at all. Start with the status code, then follow the configuration chain of the tool that failed. That is why one client can work while its neighbor fails.

What a 407 actually proves

A 407 Proxy Authentication Required comes from the proxy, not from the registry or the repository. The client reached the proxy and the proxy refused the request, usually because credentials were missing, malformed or not accepted for that destination.

A timeout tells a different story. The client may have the wrong proxy address, no route to the proxy before the tunnel is up, or a bypass entry that is missing for an internal host. Read the error text before changing credentials.

Confirm the proxy host, port, authentication scheme and whether the username needs a domain prefix. Then check whether the failing tool reads that value from a file, an environment variable or both. A domain-qualified username is a common 407 cause. So is a password stored with the wrong encoding.

npm reads its own configuration chain

npm accepts proxy and https-proxy keys in a user or project .npmrc. Include the scheme, because the values are URLs, and URL-encode reserved characters in a password so an at sign does not split the value.

proxy=http://proxy.example.com:8080
https-proxy=http://proxy.example.com:8080
strict-ssl=true

Use npm config list to see which file supplied each effective value. A shell export such as npm_config_proxy can override the file, and a project-level .npmrc that contains a personal password should never be committed. Print the source path as well as the value.

Keep strict-ssl enabled. A proxy that inspects TLS may require the corporate CA in the trust store; disabling verification to get past the error hides the actual trust problem.

Maven separates proxies from mirrors

Maven reads proxies and mirrors from the user settings file, not from the project pom. Put network-specific proxies and internal repository mirrors in ~/.m2/settings.xml, and leave public repository declarations in the project where they belong.

The proxy block needs an id, an active flag, the protocol, the host and port, and a nonProxyHosts entry for the internal repository. Put those fields in the user settings file, not the project pom, so a network change does not rewrite the build for the whole team. A mirror entry is separate and points Maven at the internal repository.

Add the internal repository to nonProxyHosts so Maven connects to it directly. Without that entry, the proxy becomes an unnecessary hop and the failure looks like a repository outage. A mirror entry points at the internal repository; it does not replace the proxy setting.

Developers who move between networks can maintain one settings file per network and select the right copy when the shell starts. Hand-editing a single file for each move is how a working laptop becomes a support ticket.

VS Code and dev containers have different namespaces

VS Code reads http.proxy from its user or workspace settings, including the scheme and port. That covers the editor's own extension and marketplace requests, but it does not automatically configure a terminal or a container launched from the editor. Check the setting scope as well as the value. A workspace setting can override the user setting for one project.

A dev container has its own network namespace. It does not inherit the host's proxy variables or the host's VPN route, which is why a marketplace call can fail inside the container while the same call works on the host.

Give the container those variables, or give it a resolver and route of its own. When names resolve inside it but the proxy never answers, the missing piece is usually the path, not the address.

Bypass lists and environment precedence

Add the VPN gateway, internal registries and private DNS suffixes to the bypass list. If the client tries to reach the VPN gateway through the proxy before the tunnel exists, the connection fails in a way that looks like a proxy outage. Test that bypass with the tunnel down.

Environment variables and files can disagree. Run the tool's own configuration dump, not the shell's, and compare the values it reports. A duplicate lower-case variable, a stale value in a parent shell or a project file can all win over the setting you just edited.

In CI, pass the proxy as a secret variable and test one package install in the same image. A 407 inside a container often means the variable is simply absent there, while the host shell has it.

Record the proxy host, port, bypass suffixes and the file or variable that supplies them for each tool. When one client returns 407 and another works, that record turns a comparison of four different configs into a short check.