From 7f9951a939a84a158dc270599e875c94f65e7b11 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Tue, 1 Oct 2024 11:56:42 -0500
Subject: [PATCH 1/2] Avoid using the proxy headers in the ConnectionKey if no
 proxy is in use (#9368)

(cherry picked from commit 02d8dba9a320e4d15d8d7539ca5fb6d93083bd26)
---
 CHANGES/9368.bugfix.rst      |  3 +++
 aiohttp/client_reqrep.py     |  8 +++++++-
 tests/test_client_request.py | 27 +++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 CHANGES/9368.bugfix.rst

diff --git a/CHANGES/9368.bugfix.rst b/CHANGES/9368.bugfix.rst
new file mode 100644
index 00000000000..fb2f90c1d4d
--- /dev/null
+++ b/CHANGES/9368.bugfix.rst
@@ -0,0 +1,3 @@
+Fixed proxy headers being used in the ``ConnectionKey`` hash when proxy was being used -- by :user:`bdraco`.
+
+If default headers are used, they are also used for proxy headers. This could have led to creating connections that were not needed when one was already available.
diff --git a/aiohttp/client_reqrep.py b/aiohttp/client_reqrep.py
index d51964a9c4d..cdfca2d53e9 100644
--- a/aiohttp/client_reqrep.py
+++ b/aiohttp/client_reqrep.py
@@ -605,10 +605,16 @@ def update_proxy(
         proxy_auth: Optional[BasicAuth],
         proxy_headers: Optional[LooseHeaders],
     ) -> None:
+        self.proxy = proxy
+        if proxy is None:
+            self.proxy_auth = None
+            self.proxy_headers = None
+            return
+
         if proxy_auth and not isinstance(proxy_auth, helpers.BasicAuth):
             raise ValueError("proxy_auth must be None or BasicAuth() tuple")
-        self.proxy = proxy
         self.proxy_auth = proxy_auth
+
         if proxy_headers is not None and not isinstance(
             proxy_headers, (MultiDict, MultiDictProxy)
         ):
diff --git a/tests/test_client_request.py b/tests/test_client_request.py
index 7853b541fc9..c9d61bf1fb7 100644
--- a/tests/test_client_request.py
+++ b/tests/test_client_request.py
@@ -1467,3 +1467,30 @@ def test_basicauth_from_empty_netrc(
     """Test that no Authorization header is sent when netrc is empty"""
     req = make_request("get", "http://example.com", trust_env=True)
     assert hdrs.AUTHORIZATION not in req.headers
+
+
+async def test_connection_key_with_proxy() -> None:
+    """Verify the proxy headers are included in the ConnectionKey when a proxy is used."""
+    proxy = URL("http://proxy.example.com")
+    req = ClientRequest(
+        "GET",
+        URL("http://example.com"),
+        proxy=proxy,
+        proxy_headers={"X-Proxy": "true"},
+        loop=asyncio.get_running_loop(),
+    )
+    assert req.connection_key.proxy_headers_hash is not None
+    await req.close()
+
+
+async def test_connection_key_without_proxy() -> None:
+    """Verify the proxy headers are not included in the ConnectionKey when a proxy is used."""
+    # If proxy is unspecified, proxy_headers should be ignored
+    req = ClientRequest(
+        "GET",
+        URL("http://example.com"),
+        proxy_headers={"X-Proxy": "true"},
+        loop=asyncio.get_running_loop(),
+    )
+    assert req.connection_key.proxy_headers_hash is None
+    await req.close()

From 7e828dd60033c51c8a9dda337e855c448f6b3d0b Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Tue, 1 Oct 2024 15:17:52 -0500
Subject: [PATCH 2/2] Update CHANGES/9368.bugfix.rst

---
 CHANGES/9368.bugfix.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGES/9368.bugfix.rst b/CHANGES/9368.bugfix.rst
index fb2f90c1d4d..7a9d8c7087e 100644
--- a/CHANGES/9368.bugfix.rst
+++ b/CHANGES/9368.bugfix.rst
@@ -1,3 +1,3 @@
-Fixed proxy headers being used in the ``ConnectionKey`` hash when proxy was being used -- by :user:`bdraco`.
+Fixed proxy headers being used in the ``ConnectionKey`` hash when a proxy was not being used -- by :user:`bdraco`.
 
 If default headers are used, they are also used for proxy headers. This could have led to creating connections that were not needed when one was already available.