Proxy authentication in Go’s net/http, HTTP and SOCKS5

package main

import (
	"fmt"
	"io"
	"net/http"
	"net/url"
	"os"
	"time"
)

func main() {
	user := os.Getenv("PROXY_USER") + "-country-de"

	proxyURL := &url.URL{
		Scheme: "http",
		// url.UserPassword escapes special characters in the password.
		User: url.UserPassword(user, os.Getenv("PROXY_PASS")),
		// Rotating ports pick a new exit per connection: HTTP 9000, SOCKS5 11000.
		Host: "via.proxies.vision:9000",
	}

	client := &http.Client{
		Transport: &http.Transport{
			Proxy: http.ProxyURL(proxyURL),
			// Without this, Go reuses the open tunnel and every request leaves
			// through the same IP. One connection per request = one IP per request.
			DisableKeepAlives: true,
		},
		Timeout: 30 * time.Second,
	}

	for i := 1; i <= 3; i++ {
		body, err := fetch(client, "https://ipinfo.io/json", 3)
		if err != nil {
			fmt.Println("request failed:", err)
			continue
		}
		fmt.Printf("request %d: %s\n", i, body)
	}
}

// fetch retries on network errors: residential exits occasionally drop a
// connection mid-request (Go reports EOF), and the next attempt gets a
// healthy one. Proxy refusals (403, 407, 465) come back as errors too.
func fetch(client *http.Client, target string, attempts int) ([]byte, error) {
	var lastErr error
	for i := 0; i < attempts; i++ {
		resp, err := client.Get(target)
		if err != nil {
			lastErr = err
			time.Sleep(time.Duration(i+1) * 500 * time.Millisecond)
			continue
		}
		body, err := io.ReadAll(resp.Body)
		resp.Body.Close()
		if err != nil {
			lastErr = err
			continue
		}
		if resp.StatusCode >= 500 {
			lastErr = fmt.Errorf("target answered %s", resp.Status)
			continue
		}
		return body, nil
	}
	return nil, lastErr
}