From 6ab718f8134d1445fe05e2e26663fc29a6b45d30 Mon Sep 17 00:00:00 2001
From: Kirill Rudenko <cs1@list.ru>
Date: Sat, 26 Sep 2026 23:03:20 +0300
Subject: [PATCH] fix(sub): make Happ require auth on its local SOCKS/HTTP
 proxy (#6628)

Happ ships its local SOCKS5 (127.0.0.1:10808) and HTTP inbounds with
authorization disabled by default. Any app on the same device can then
connect to that proxy, bypassing Android's per-app VPN routing, and learn
the VPN server address - the leak publicly described in March-April 2026
for Happ, v2rayNG and other VLESS clients. Happ fixed its Xray API
exposure, but the unauthenticated local proxy remained.

Happ exposes a standard subscription header for this (no Provider ID
required): socks-auth-mode / http-auth-mode = auto|manual|from-json|
disable. A new subscription setting, subHappLocalProxyAuth (default
"auto"), sends both headers to Happ clients. Like every other Happ header
it is emitted only when Happ auto-detect is enabled and the User-Agent is
Happ, so panels that never opted into the Happ integration see no change.
An empty value sends nothing and keeps the client's own setting.

Verified on Happ Android 4.4.1 (Xray 26.7.28): a subscription carrying
socks-auth-mode manual + a test user/password switched the client's
Inbounds screen to Manual with those credentials on "refresh subscription",
and "auto" switched it to Auto with generated credentials.

Co-authored-by: Kirill Rudenko <rudenko@npp-energy.ru>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Sanaei <ho3ein.sanaei@gmail.com>
---
 docs/public/openapi.json                      |  8 +++++
 frontend/public/openapi.json                  |  8 +++++
 frontend/src/generated/examples.ts            |  2 ++
 frontend/src/generated/schemas.ts             |  8 +++++
 frontend/src/generated/types.ts               |  2 ++
 frontend/src/generated/zod.ts                 |  2 ++
 frontend/src/models/setting.ts                |  1 +
 .../pages/settings/HappSettingsContent.tsx    | 17 ++++++++++
 frontend/src/schemas/setting.ts               |  1 +
 internal/sub/happ.go                          |  7 ++++
 internal/sub/happ_test.go                     | 34 +++++++++++++++++++
 internal/sub/sub.go                           |  1 +
 internal/web/entity/entity.go                 |  1 +
 internal/web/service/setting.go               |  5 +++
 internal/web/translation/ar-EG.json           |  5 +++
 internal/web/translation/en-US.json           |  5 +++
 internal/web/translation/es-ES.json           |  5 +++
 internal/web/translation/fa-IR.json           |  5 +++
 internal/web/translation/id-ID.json           |  5 +++
 internal/web/translation/ja-JP.json           |  5 +++
 internal/web/translation/pt-BR.json           |  5 +++
 internal/web/translation/ru-RU.json           |  5 +++
 internal/web/translation/tr-TR.json           |  5 +++
 internal/web/translation/uk-UA.json           |  5 +++
 internal/web/translation/vi-VN.json           |  5 +++
 internal/web/translation/zh-CN.json           |  5 +++
 internal/web/translation/zh-TW.json           |  5 +++
 27 files changed, 162 insertions(+)

diff --git a/docs/public/openapi.json b/docs/public/openapi.json
index d35139a3b..ae423a7fa 100644
--- a/docs/public/openapi.json
+++ b/docs/public/openapi.json
@@ -288,6 +288,9 @@
           "subHappFallbackUrl": {
             "type": "string"
           },
+          "subHappLocalProxyAuth": {
+            "type": "string"
+          },
           "subHappNewUrl": {
             "type": "string"
           },
@@ -586,6 +589,7 @@
           "subHappExcludeApns",
           "subHappExcludeRoutes",
           "subHappFallbackUrl",
+          "subHappLocalProxyAuth",
           "subHappNewUrl",
           "subHappNoLimit",
           "subHappNotificationExpire",
@@ -943,6 +947,9 @@
           "subHappFallbackUrl": {
             "type": "string"
           },
+          "subHappLocalProxyAuth": {
+            "type": "string"
+          },
           "subHappNewUrl": {
             "type": "string"
           },
@@ -1249,6 +1256,7 @@
           "subHappExcludeApns",
           "subHappExcludeRoutes",
           "subHappFallbackUrl",
+          "subHappLocalProxyAuth",
           "subHappNewUrl",
           "subHappNoLimit",
           "subHappNotificationExpire",
diff --git a/frontend/public/openapi.json b/frontend/public/openapi.json
index d35139a3b..ae423a7fa 100644
--- a/frontend/public/openapi.json
+++ b/frontend/public/openapi.json
@@ -288,6 +288,9 @@
           "subHappFallbackUrl": {
             "type": "string"
           },
+          "subHappLocalProxyAuth": {
+            "type": "string"
+          },
           "subHappNewUrl": {
             "type": "string"
           },
@@ -586,6 +589,7 @@
           "subHappExcludeApns",
           "subHappExcludeRoutes",
           "subHappFallbackUrl",
+          "subHappLocalProxyAuth",
           "subHappNewUrl",
           "subHappNoLimit",
           "subHappNotificationExpire",
@@ -943,6 +947,9 @@
           "subHappFallbackUrl": {
             "type": "string"
           },
+          "subHappLocalProxyAuth": {
+            "type": "string"
+          },
           "subHappNewUrl": {
             "type": "string"
           },
@@ -1249,6 +1256,7 @@
           "subHappExcludeApns",
           "subHappExcludeRoutes",
           "subHappFallbackUrl",
+          "subHappLocalProxyAuth",
           "subHappNewUrl",
           "subHappNoLimit",
           "subHappNotificationExpire",
diff --git a/frontend/src/generated/examples.ts b/frontend/src/generated/examples.ts
index 190ca1c07..27cb25065 100644
--- a/frontend/src/generated/examples.ts
+++ b/frontend/src/generated/examples.ts
@@ -80,6 +80,7 @@ export const EXAMPLES: Record<string, unknown> = {
     "subHappExcludeApns": false,
     "subHappExcludeRoutes": "",
     "subHappFallbackUrl": "",
+    "subHappLocalProxyAuth": "",
     "subHappNewUrl": "",
     "subHappNoLimit": false,
     "subHappNotificationExpire": false,
@@ -237,6 +238,7 @@ export const EXAMPLES: Record<string, unknown> = {
     "subHappExcludeApns": false,
     "subHappExcludeRoutes": "",
     "subHappFallbackUrl": "",
+    "subHappLocalProxyAuth": "",
     "subHappNewUrl": "",
     "subHappNoLimit": false,
     "subHappNotificationExpire": false,
diff --git a/frontend/src/generated/schemas.ts b/frontend/src/generated/schemas.ts
index ee8650062..db8e7761e 100644
--- a/frontend/src/generated/schemas.ts
+++ b/frontend/src/generated/schemas.ts
@@ -262,6 +262,9 @@ export const SCHEMAS: Record<string, unknown> = {
       "subHappFallbackUrl": {
         "type": "string"
       },
+      "subHappLocalProxyAuth": {
+        "type": "string"
+      },
       "subHappNewUrl": {
         "type": "string"
       },
@@ -560,6 +563,7 @@ export const SCHEMAS: Record<string, unknown> = {
       "subHappExcludeApns",
       "subHappExcludeRoutes",
       "subHappFallbackUrl",
+      "subHappLocalProxyAuth",
       "subHappNewUrl",
       "subHappNoLimit",
       "subHappNotificationExpire",
@@ -917,6 +921,9 @@ export const SCHEMAS: Record<string, unknown> = {
       "subHappFallbackUrl": {
         "type": "string"
       },
+      "subHappLocalProxyAuth": {
+        "type": "string"
+      },
       "subHappNewUrl": {
         "type": "string"
       },
@@ -1223,6 +1230,7 @@ export const SCHEMAS: Record<string, unknown> = {
       "subHappExcludeApns",
       "subHappExcludeRoutes",
       "subHappFallbackUrl",
+      "subHappLocalProxyAuth",
       "subHappNewUrl",
       "subHappNoLimit",
       "subHappNotificationExpire",
diff --git a/frontend/src/generated/types.ts b/frontend/src/generated/types.ts
index bb916a8b1..c9070e73c 100644
--- a/frontend/src/generated/types.ts
+++ b/frontend/src/generated/types.ts
@@ -87,6 +87,7 @@ export interface AllSetting {
   subHappExcludeApns: boolean;
   subHappExcludeRoutes: string;
   subHappFallbackUrl: string;
+  subHappLocalProxyAuth: string;
   subHappNewUrl: string;
   subHappNoLimit: boolean;
   subHappNotificationExpire: boolean;
@@ -245,6 +246,7 @@ export interface AllSettingView {
   subHappExcludeApns: boolean;
   subHappExcludeRoutes: string;
   subHappFallbackUrl: string;
+  subHappLocalProxyAuth: string;
   subHappNewUrl: string;
   subHappNoLimit: boolean;
   subHappNotificationExpire: boolean;
diff --git a/frontend/src/generated/zod.ts b/frontend/src/generated/zod.ts
index deb007369..e04f3a14a 100644
--- a/frontend/src/generated/zod.ts
+++ b/frontend/src/generated/zod.ts
@@ -101,6 +101,7 @@ export const AllSettingSchema = z.object({
   subHappExcludeApns: z.boolean(),
   subHappExcludeRoutes: z.string(),
   subHappFallbackUrl: z.string(),
+  subHappLocalProxyAuth: z.string(),
   subHappNewUrl: z.string(),
   subHappNoLimit: z.boolean(),
   subHappNotificationExpire: z.boolean(),
@@ -260,6 +261,7 @@ export const AllSettingViewSchema = z.object({
   subHappExcludeApns: z.boolean(),
   subHappExcludeRoutes: z.string(),
   subHappFallbackUrl: z.string(),
+  subHappLocalProxyAuth: z.string(),
   subHappNewUrl: z.string(),
   subHappNoLimit: z.boolean(),
   subHappNotificationExpire: z.boolean(),
diff --git a/frontend/src/models/setting.ts b/frontend/src/models/setting.ts
index 38fffa794..65598828c 100644
--- a/frontend/src/models/setting.ts
+++ b/frontend/src/models/setting.ts
@@ -104,6 +104,7 @@ export class AllSetting {
   subHappAutoConnectType = 'lowestdelay';
   subHappPerAppMode = 'off';
   subHappPerAppList = '';
+  subHappLocalProxyAuth = 'auto';
 
   timeLocation = 'Local';
 
diff --git a/frontend/src/pages/settings/HappSettingsContent.tsx b/frontend/src/pages/settings/HappSettingsContent.tsx
index bba39a454..6434330ac 100644
--- a/frontend/src/pages/settings/HappSettingsContent.tsx
+++ b/frontend/src/pages/settings/HappSettingsContent.tsx
@@ -382,6 +382,23 @@ export default function HappSettingsContent({
                   />
                 </SettingListItem>
 
+                <SettingListItem
+                  paddings="small"
+                  title={t('pages.settings.subHappLocalProxyAuth')}
+                  description={t('pages.settings.subHappLocalProxyAuthDesc')}
+                >
+                  <Select
+                    value={allSetting.subHappLocalProxyAuth ?? 'auto'}
+                    style={{ width: '100%' }}
+                    onChange={(v) => updateSetting({ subHappLocalProxyAuth: v })}
+                    options={[
+                      { value: 'auto', label: t('pages.settings.subHappLocalProxyAuthAuto') },
+                      { value: 'disable', label: t('pages.settings.subHappLocalProxyAuthDisable') },
+                      { value: '', label: t('pages.settings.subHappLocalProxyAuthUnset') },
+                    ]}
+                  />
+                </SettingListItem>
+
                 <SettingListItem
                   paddings="small"
                   title={t('pages.settings.subHappAutoConnect')}
diff --git a/frontend/src/schemas/setting.ts b/frontend/src/schemas/setting.ts
index 10ab1af61..250d108ac 100644
--- a/frontend/src/schemas/setting.ts
+++ b/frontend/src/schemas/setting.ts
@@ -109,6 +109,7 @@ export const AllSettingSchema = z
     subHappAutoConnectType: z.string().optional(),
     subHappPerAppMode: z.string().optional(),
     subHappPerAppList: z.string().optional(),
+    subHappLocalProxyAuth: z.string().optional(),
     timeLocation: z.string().optional(),
     ldapEnable: z.boolean().optional(),
     ldapHost: z.string().optional(),
diff --git a/internal/sub/happ.go b/internal/sub/happ.go
index b1056526a..d971b883e 100644
--- a/internal/sub/happ.go
+++ b/internal/sub/happ.go
@@ -34,6 +34,7 @@ type HappConfig struct {
 	AutoConnectType     string
 	PerAppMode          string
 	PerAppList          string
+	LocalProxyAuth      string
 }
 
 // IsHappClient checks if the client user-agent identifies as Happ.
@@ -129,6 +130,12 @@ func ApplyHappHeaders(c *gin.Context, cfg HappConfig, isHapp bool) {
 			c.Writer.Header().Set("Subscription-Autoconnect-Type", autoType)
 		}
 	}
+	// Happ's local SOCKS/HTTP inbounds default to no auth, so any app on the device can use them
+	// to reach the tunnel and learn the server address; these are standard headers (no ProviderID).
+	if mode := strings.TrimSpace(cfg.LocalProxyAuth); mode != "" {
+		c.Writer.Header().Set("Socks-Auth-Mode", mode)
+		c.Writer.Header().Set("Http-Auth-Mode", mode)
+	}
 	if mode := strings.TrimSpace(cfg.PerAppMode); mode != "" && mode != "off" {
 		switch strings.ToLower(mode) {
 		case "include":
diff --git a/internal/sub/happ_test.go b/internal/sub/happ_test.go
index 1d1985bf6..369476bdf 100644
--- a/internal/sub/happ_test.go
+++ b/internal/sub/happ_test.go
@@ -348,3 +348,37 @@ func TestIsHappClient(t *testing.T) {
 		}
 	}
 }
+
+func TestApplyHappHeaders_LocalProxyAuth(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	cases := []struct {
+		name       string
+		autoDetect bool
+		userAgent  string
+		mode       string
+		want       string
+	}{
+		{"Happ gets auto for both inbounds", true, "Happ/4.4.1 (Android)", "auto", "auto"},
+		{"explicit disable is forwarded", true, "Happ/4.4.1 (Android)", "disable", "disable"},
+		{"empty mode sends nothing", true, "Happ/4.4.1 (Android)", "", ""},
+		{"non-Happ client gets nothing", true, "v2rayNG/1.8.5", "auto", ""},
+		{"AutoDetect off sends nothing", false, "Happ/4.4.1 (Android)", "auto", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			ctx, _ := gin.CreateTestContext(recorder)
+			ctx.Request = httptest.NewRequest(http.MethodGet, "/sub/test", nil)
+			ctx.Request.Header.Set("User-Agent", tc.userAgent)
+
+			controller := &SUBController{happConfig: HappConfig{AutoDetect: tc.autoDetect, LocalProxyAuth: tc.mode}}
+			controller.ApplyCommonHeaders(ctx, "", "", "Title", "", "", "", false, "", false)
+
+			for _, h := range []string{"Socks-Auth-Mode", "Http-Auth-Mode"} {
+				if got := recorder.Header().Get(h); got != tc.want {
+					t.Fatalf("%s = %q, want %q", h, got, tc.want)
+				}
+			}
+		})
+	}
+}
diff --git a/internal/sub/sub.go b/internal/sub/sub.go
index 566705f66..578c3ae87 100644
--- a/internal/sub/sub.go
+++ b/internal/sub/sub.go
@@ -253,6 +253,7 @@ func (s *Server) initRouter() (*gin.Engine, error) {
 	happCfg.AutoConnectType, _ = s.settingService.GetSubHappAutoConnectType()
 	happCfg.PerAppMode, _ = s.settingService.GetSubHappPerAppMode()
 	happCfg.PerAppList, _ = s.settingService.GetSubHappPerAppList()
+	happCfg.LocalProxyAuth, _ = s.settingService.GetSubHappLocalProxyAuth()
 
 	// set per-request localizer from headers/cookies
 	engine.Use(locale.LocalizerMiddleware())
diff --git a/internal/web/entity/entity.go b/internal/web/entity/entity.go
index a69fc7e8d..a4aecd6a7 100644
--- a/internal/web/entity/entity.go
+++ b/internal/web/entity/entity.go
@@ -153,6 +153,7 @@ type AllSetting struct {
 	SubHappAutoConnectType     string `json:"subHappAutoConnectType" form:"subHappAutoConnectType"`
 	SubHappPerAppMode          string `json:"subHappPerAppMode" form:"subHappPerAppMode"`
 	SubHappPerAppList          string `json:"subHappPerAppList" form:"subHappPerAppList"`
+	SubHappLocalProxyAuth      string `json:"subHappLocalProxyAuth" form:"subHappLocalProxyAuth"`
 
 	LdapEnable             bool   `json:"ldapEnable" form:"ldapEnable"`
 	LdapHost               string `json:"ldapHost" form:"ldapHost"`
diff --git a/internal/web/service/setting.go b/internal/web/service/setting.go
index 097dda4e8..aeee1e877 100644
--- a/internal/web/service/setting.go
+++ b/internal/web/service/setting.go
@@ -137,6 +137,7 @@ var defaultValueMap = map[string]string{
 	"subHappAutoConnectType":      "lowestdelay",
 	"subHappPerAppMode":           "off",
 	"subHappPerAppList":           "",
+	"subHappLocalProxyAuth":       "auto",
 	"subIncyEnableRouting":        "false",
 	"subIncyRoutingRules":         "",
 	"subListen":                   "",
@@ -999,6 +1000,10 @@ func (s *SettingService) GetSubHappPerAppList() (string, error) {
 	return s.getString("subHappPerAppList")
 }
 
+func (s *SettingService) GetSubHappLocalProxyAuth() (string, error) {
+	return s.getString("subHappLocalProxyAuth")
+}
+
 func (s *SettingService) GetSubIncyEnableRouting() (bool, error) {
 	return s.getBool("subIncyEnableRouting")
 }
diff --git a/internal/web/translation/ar-EG.json b/internal/web/translation/ar-EG.json
index 3b83b1dfa..8000fa6f8 100644
--- a/internal/web/translation/ar-EG.json
+++ b/internal/web/translation/ar-EG.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "سمة ألوان مخصصة لـ iOS كسلسلة JSON، أو resetcolors لاستعادة الألوان الافتراضية.",
       "subHappPingType": "طريقة قياس زمن الاستجابة",
       "subHappPingTypeDesc": "كيفية قياس Happ لزمن استجابة العقد: عبر البروكسي (GET أو HEAD) أو TCP أو ICMP.",
+      "subHappLocalProxyAuth": "مصادقة الوكيل المحلي",
+      "subHappLocalProxyAuthDesc": "يرسل إلى Happ الترويسات socks-auth-mode / http-auth-mode. بدون مصادقة يمكن لأي تطبيق على الجهاز استخدام وكيل SOCKS5/HTTP المحلي في Happ للوصول إلى النفق ومعرفة عنوان الخادم. \"تلقائي\" يجعل Happ ينشئ بيانات اعتماد عشوائية؛ لا يلزم Provider ID.",
+      "subHappLocalProxyAuthAuto": "تلقائي (بيانات اعتماد عشوائية)",
+      "subHappLocalProxyAuthDisable": "معطل",
+      "subHappLocalProxyAuthUnset": "عدم الإرسال (الافتراضي في العميل)",
       "subHappAutoConnect": "الاتصال التلقائي عند التشغيل",
       "subHappAutoConnectDesc": "يتصل Happ تلقائيًا بـ VPN عند بدء تشغيل التطبيق.",
       "subHappAutoConnectType": "هدف الاتصال التلقائي",
diff --git a/internal/web/translation/en-US.json b/internal/web/translation/en-US.json
index f0a53b970..6adfddec0 100644
--- a/internal/web/translation/en-US.json
+++ b/internal/web/translation/en-US.json
@@ -1676,6 +1676,11 @@
       "subHappColorProfileDesc": "Custom iOS color theme as a JSON string, or resetcolors to restore the default colors.",
       "subHappPingType": "Latency Ping Method",
       "subHappPingTypeDesc": "How Happ measures node latency: via proxy (GET or HEAD), TCP, or ICMP.",
+      "subHappLocalProxyAuth": "Local Proxy Authorization",
+      "subHappLocalProxyAuthDesc": "Sends Happ socks-auth-mode / http-auth-mode. Without authorization, any app on the device can use Happ's local SOCKS5/HTTP proxy to reach the tunnel and learn the server address. \"Auto\" makes Happ generate random credentials; works without a Provider ID.",
+      "subHappLocalProxyAuthAuto": "Auto (random credentials)",
+      "subHappLocalProxyAuthDisable": "Disabled",
+      "subHappLocalProxyAuthUnset": "Not sent (client default)",
       "subHappAutoConnect": "Auto-Connect on Launch",
       "subHappAutoConnectDesc": "Instruct Happ to automatically connect to VPN when the application starts.",
       "subHappAutoConnectType": "Auto-Connect Target",
diff --git a/internal/web/translation/es-ES.json b/internal/web/translation/es-ES.json
index 342cf2400..715075f3b 100644
--- a/internal/web/translation/es-ES.json
+++ b/internal/web/translation/es-ES.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "Tema de color personalizado para iOS como cadena JSON, o resetcolors para restaurar los colores predeterminados.",
       "subHappPingType": "Método de ping de latencia",
       "subHappPingTypeDesc": "Cómo mide Happ la latencia de los nodos: vía proxy (GET o HEAD), TCP o ICMP.",
+      "subHappLocalProxyAuth": "Autorización del proxy local",
+      "subHappLocalProxyAuthDesc": "Envía a Happ socks-auth-mode / http-auth-mode. Sin autorización, cualquier app del dispositivo puede usar el proxy SOCKS5/HTTP local de Happ para llegar al túnel y conocer la dirección del servidor. \"Auto\" hace que Happ genere credenciales aleatorias; no requiere Provider ID.",
+      "subHappLocalProxyAuthAuto": "Auto (credenciales aleatorias)",
+      "subHappLocalProxyAuthDisable": "Desactivada",
+      "subHappLocalProxyAuthUnset": "No enviar (predeterminado del cliente)",
       "subHappAutoConnect": "Conexión automática al iniciar",
       "subHappAutoConnectDesc": "Indicar a Happ que se conecte automáticamente a la VPN al iniciarse la aplicación.",
       "subHappAutoConnectType": "Destino de la conexión automática",
diff --git a/internal/web/translation/fa-IR.json b/internal/web/translation/fa-IR.json
index 7c607c8d8..0ce5f981e 100644
--- a/internal/web/translation/fa-IR.json
+++ b/internal/web/translation/fa-IR.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "تم رنگی سفارشی iOS به صورت رشته JSON، یا resetcolors برای بازگشت به رنگ‌های پیش‌فرض.",
       "subHappPingType": "روش تست پینگ",
       "subHappPingTypeDesc": "روش اندازه‌گیری تأخیر نودها در Happ: از طریق پروکسی (GET یا HEAD)، TCP یا ICMP.",
+      "subHappLocalProxyAuth": "احراز هویت پروکسی محلی",
+      "subHappLocalProxyAuthDesc": "هدرهای socks-auth-mode / http-auth-mode را به Happ می‌فرستد. بدون احراز هویت، هر برنامه‌ای روی دستگاه می‌تواند از پروکسی محلی SOCKS5/HTTP برنامه Happ به تونل برسد و نشانی سرور را بفهمد. «خودکار» باعث می‌شود Happ اعتبارنامه تصادفی بسازد؛ به Provider ID نیازی نیست.",
+      "subHappLocalProxyAuthAuto": "خودکار (اعتبارنامه تصادفی)",
+      "subHappLocalProxyAuthDisable": "غیرفعال",
+      "subHappLocalProxyAuthUnset": "ارسال نشود (پیش‌فرض کلاینت)",
       "subHappAutoConnect": "اتصال خودکار هنگام اجرا",
       "subHappAutoConnectDesc": "اتصال خودکار به وی‌پی‌ان با باز شدن برنامه Happ.",
       "subHappAutoConnectType": "راهبرد اتصال خودکار",
diff --git a/internal/web/translation/id-ID.json b/internal/web/translation/id-ID.json
index fabb7661a..190f3bda6 100644
--- a/internal/web/translation/id-ID.json
+++ b/internal/web/translation/id-ID.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "Tema warna iOS kustom sebagai string JSON, atau resetcolors untuk mengembalikan warna bawaan.",
       "subHappPingType": "Metode Ping Latensi",
       "subHappPingTypeDesc": "Cara Happ mengukur latensi node: melalui proxy (GET atau HEAD), TCP, atau ICMP.",
+      "subHappLocalProxyAuth": "Otorisasi Proxy Lokal",
+      "subHappLocalProxyAuthDesc": "Mengirim socks-auth-mode / http-auth-mode ke Happ. Tanpa otorisasi, aplikasi apa pun di perangkat dapat memakai proxy SOCKS5/HTTP lokal Happ untuk masuk ke terowongan dan mengetahui alamat server. \"Auto\" membuat Happ membuat kredensial acak; tidak memerlukan Provider ID.",
+      "subHappLocalProxyAuthAuto": "Auto (kredensial acak)",
+      "subHappLocalProxyAuthDisable": "Nonaktif",
+      "subHappLocalProxyAuthUnset": "Tidak dikirim (bawaan klien)",
       "subHappAutoConnect": "Hubungkan Otomatis saat Dibuka",
       "subHappAutoConnectDesc": "Minta Happ terhubung ke VPN secara otomatis saat aplikasi dimulai.",
       "subHappAutoConnectType": "Target Koneksi Otomatis",
diff --git a/internal/web/translation/ja-JP.json b/internal/web/translation/ja-JP.json
index 21c835b10..65402927b 100644
--- a/internal/web/translation/ja-JP.json
+++ b/internal/web/translation/ja-JP.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "iOS 用のカスタムカラーテーマを JSON 文字列で指定します。デフォルトの色に戻すには resetcolors を指定します。",
       "subHappPingType": "遅延の測定方法",
       "subHappPingTypeDesc": "Happ がノードの遅延を測定する方法: プロキシ経由 (GET または HEAD)、TCP、または ICMP。",
+      "subHappLocalProxyAuth": "ローカルプロキシの認証",
+      "subHappLocalProxyAuthDesc": "Happ に socks-auth-mode / http-auth-mode を送信します。認証がないと、端末上のどのアプリも Happ のローカル SOCKS5/HTTP プロキシ経由でトンネルに入り、サーバーのアドレスを知ることができます。「自動」では Happ がランダムな認証情報を生成します。Provider ID は不要です。",
+      "subHappLocalProxyAuthAuto": "自動 (ランダムな認証情報)",
+      "subHappLocalProxyAuthDisable": "無効",
+      "subHappLocalProxyAuthUnset": "送信しない (クライアントの既定)",
       "subHappAutoConnect": "起動時に自動接続",
       "subHappAutoConnectDesc": "アプリの起動時に VPN へ自動接続するよう Happ に指示します。",
       "subHappAutoConnectType": "自動接続先",
diff --git a/internal/web/translation/pt-BR.json b/internal/web/translation/pt-BR.json
index 821065b8a..85c810c2d 100644
--- a/internal/web/translation/pt-BR.json
+++ b/internal/web/translation/pt-BR.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "Tema de cores personalizado do iOS como string JSON, ou resetcolors para restaurar as cores padrão.",
       "subHappPingType": "Método de ping de latência",
       "subHappPingTypeDesc": "Como o Happ mede a latência dos nós: via proxy (GET ou HEAD), TCP ou ICMP.",
+      "subHappLocalProxyAuth": "Autorização do proxy local",
+      "subHappLocalProxyAuthDesc": "Envia ao Happ socks-auth-mode / http-auth-mode. Sem autorização, qualquer app do dispositivo pode usar o proxy SOCKS5/HTTP local do Happ para alcançar o túnel e descobrir o endereço do servidor. \"Auto\" faz o Happ gerar credenciais aleatórias; não requer Provider ID.",
+      "subHappLocalProxyAuthAuto": "Auto (credenciais aleatórias)",
+      "subHappLocalProxyAuthDisable": "Desativada",
+      "subHappLocalProxyAuthUnset": "Não enviar (padrão do cliente)",
       "subHappAutoConnect": "Conectar automaticamente ao iniciar",
       "subHappAutoConnectDesc": "Instrui o Happ a conectar automaticamente à VPN quando o aplicativo for iniciado.",
       "subHappAutoConnectType": "Destino da conexão automática",
diff --git a/internal/web/translation/ru-RU.json b/internal/web/translation/ru-RU.json
index fe099cc23..4eec62605 100644
--- a/internal/web/translation/ru-RU.json
+++ b/internal/web/translation/ru-RU.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "Своя цветовая тема для iOS в виде JSON-строки или resetcolors для сброса к стандартным цветам.",
       "subHappPingType": "Метод проверки пинга",
       "subHappPingTypeDesc": "Способ измерения задержки узлов в Happ: через прокси (GET или HEAD), TCP или ICMP.",
+      "subHappLocalProxyAuth": "Авторизация локального прокси",
+      "subHappLocalProxyAuthDesc": "Отправляет Happ заголовки socks-auth-mode / http-auth-mode. Без авторизации любое приложение на устройстве может через локальный SOCKS5/HTTP-прокси Happ попасть в туннель и узнать адрес сервера. «Авто» — Happ сам создаёт случайные учётные данные; Provider ID не нужен.",
+      "subHappLocalProxyAuthAuto": "Авто (случайные учётные данные)",
+      "subHappLocalProxyAuthDisable": "Отключена",
+      "subHappLocalProxyAuthUnset": "Не отправлять (по умолчанию клиента)",
       "subHappAutoConnect": "Автоподключение при запуске",
       "subHappAutoConnectDesc": "Автоматически подключаться к серверу при запуске приложения.",
       "subHappAutoConnectType": "Критерий автоподключения",
diff --git a/internal/web/translation/tr-TR.json b/internal/web/translation/tr-TR.json
index ad5cfcfa7..5d482e724 100644
--- a/internal/web/translation/tr-TR.json
+++ b/internal/web/translation/tr-TR.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "JSON dizesi olarak özel iOS renk teması veya varsayılan renkleri geri yüklemek için resetcolors.",
       "subHappPingType": "Gecikme Ping Yöntemi",
       "subHappPingTypeDesc": "Happ'in düğüm gecikmesini ölçme yöntemi: proxy üzerinden (GET veya HEAD), TCP veya ICMP.",
+      "subHappLocalProxyAuth": "Yerel Proxy Yetkilendirmesi",
+      "subHappLocalProxyAuthDesc": "Happ'e socks-auth-mode / http-auth-mode gönderir. Yetkilendirme olmadan cihazdaki herhangi bir uygulama Happ'in yerel SOCKS5/HTTP proxy'sini kullanarak tünele erişebilir ve sunucu adresini öğrenebilir. \"Otomatik\" Happ'in rastgele kimlik bilgileri üretmesini sağlar; Provider ID gerekmez.",
+      "subHappLocalProxyAuthAuto": "Otomatik (rastgele kimlik bilgileri)",
+      "subHappLocalProxyAuthDisable": "Devre dışı",
+      "subHappLocalProxyAuthUnset": "Gönderilmez (istemci varsayılanı)",
       "subHappAutoConnect": "Açılışta Otomatik Bağlan",
       "subHappAutoConnectDesc": "Uygulama başladığında Happ'in VPN'e otomatik olarak bağlanmasını sağlar.",
       "subHappAutoConnectType": "Otomatik Bağlantı Hedefi",
diff --git a/internal/web/translation/uk-UA.json b/internal/web/translation/uk-UA.json
index 4dd8296ba..bf2742ecf 100644
--- a/internal/web/translation/uk-UA.json
+++ b/internal/web/translation/uk-UA.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "Власна колірна тема iOS у вигляді рядка JSON або resetcolors для відновлення стандартних кольорів.",
       "subHappPingType": "Метод вимірювання затримки",
       "subHappPingTypeDesc": "Як Happ вимірює затримку вузлів: через проксі (GET або HEAD), TCP або ICMP.",
+      "subHappLocalProxyAuth": "Авторизація локального проксі",
+      "subHappLocalProxyAuthDesc": "Надсилає Happ заголовки socks-auth-mode / http-auth-mode. Без авторизації будь-який застосунок на пристрої може через локальний SOCKS5/HTTP-проксі Happ потрапити в тунель і дізнатися адресу сервера. «Авто» — Happ сам створює випадкові облікові дані; Provider ID не потрібен.",
+      "subHappLocalProxyAuthAuto": "Авто (випадкові облікові дані)",
+      "subHappLocalProxyAuthDisable": "Вимкнена",
+      "subHappLocalProxyAuthUnset": "Не надсилати (типово для клієнта)",
       "subHappAutoConnect": "Автопідключення під час запуску",
       "subHappAutoConnectDesc": "Доручити Happ автоматично підключатися до VPN під час запуску програми.",
       "subHappAutoConnectType": "Ціль автопідключення",
diff --git a/internal/web/translation/vi-VN.json b/internal/web/translation/vi-VN.json
index a01524027..e6a08ff42 100644
--- a/internal/web/translation/vi-VN.json
+++ b/internal/web/translation/vi-VN.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "Chủ đề màu iOS tùy chỉnh dưới dạng chuỗi JSON, hoặc resetcolors để khôi phục màu mặc định.",
       "subHappPingType": "Phương thức đo độ trễ",
       "subHappPingTypeDesc": "Cách Happ đo độ trễ của nút: qua proxy (GET hoặc HEAD), TCP hoặc ICMP.",
+      "subHappLocalProxyAuth": "Xác thực proxy cục bộ",
+      "subHappLocalProxyAuthDesc": "Gửi socks-auth-mode / http-auth-mode cho Happ. Không có xác thực, bất kỳ ứng dụng nào trên thiết bị cũng có thể dùng proxy SOCKS5/HTTP cục bộ của Happ để vào đường hầm và biết địa chỉ máy chủ. \"Tự động\" khiến Happ tạo thông tin đăng nhập ngẫu nhiên; không cần Provider ID.",
+      "subHappLocalProxyAuthAuto": "Tự động (thông tin ngẫu nhiên)",
+      "subHappLocalProxyAuthDisable": "Tắt",
+      "subHappLocalProxyAuthUnset": "Không gửi (mặc định của ứng dụng)",
       "subHappAutoConnect": "Tự động kết nối khi khởi động",
       "subHappAutoConnectDesc": "Yêu cầu Happ tự động kết nối VPN khi ứng dụng khởi động.",
       "subHappAutoConnectType": "Mục tiêu tự động kết nối",
diff --git a/internal/web/translation/zh-CN.json b/internal/web/translation/zh-CN.json
index 3a3d7656f..4ee64f302 100644
--- a/internal/web/translation/zh-CN.json
+++ b/internal/web/translation/zh-CN.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "以 JSON 字符串自定义 iOS 配色主题，或填写 resetcolors 恢复默认颜色。",
       "subHappPingType": "延迟测速协议",
       "subHappPingTypeDesc": "Happ 测量节点延迟的方式：经由代理 (GET 或 HEAD)、TCP 或 ICMP。",
+      "subHappLocalProxyAuth": "本地代理认证",
+      "subHappLocalProxyAuthDesc": "向 Happ 发送 socks-auth-mode / http-auth-mode。没有认证时，设备上的任何应用都能通过 Happ 的本地 SOCKS5/HTTP 代理进入隧道并获知服务器地址。\"自动\" 让 Happ 生成随机凭据；无需 Provider ID。",
+      "subHappLocalProxyAuthAuto": "自动（随机凭据）",
+      "subHappLocalProxyAuthDisable": "禁用",
+      "subHappLocalProxyAuthUnset": "不发送（客户端默认）",
       "subHappAutoConnect": "启动时自动连接",
       "subHappAutoConnectDesc": "Happ 客户端打开时自动连接代理节点。",
       "subHappAutoConnectType": "自动连接策略",
diff --git a/internal/web/translation/zh-TW.json b/internal/web/translation/zh-TW.json
index e58153469..c1beaaf04 100644
--- a/internal/web/translation/zh-TW.json
+++ b/internal/web/translation/zh-TW.json
@@ -1558,6 +1558,11 @@
       "subHappColorProfileDesc": "以 JSON 字串自訂 iOS 顏色主題，或填入 resetcolors 以還原預設顏色。",
       "subHappPingType": "延遲測試方式",
       "subHappPingTypeDesc": "Happ 測量節點延遲的方式：經由代理（GET 或 HEAD）、TCP 或 ICMP。",
+      "subHappLocalProxyAuth": "本機代理驗證",
+      "subHappLocalProxyAuthDesc": "向 Happ 傳送 socks-auth-mode / http-auth-mode。沒有驗證時，裝置上的任何應用程式都能透過 Happ 的本機 SOCKS5/HTTP 代理進入通道並得知伺服器位址。「自動」讓 Happ 產生隨機憑證；不需要 Provider ID。",
+      "subHappLocalProxyAuthAuto": "自動（隨機憑證）",
+      "subHappLocalProxyAuthDisable": "停用",
+      "subHappLocalProxyAuthUnset": "不傳送（用戶端預設）",
       "subHappAutoConnect": "啟動時自動連線",
       "subHappAutoConnectDesc": "指示 Happ 在應用程式啟動時自動連線至 VPN。",
       "subHappAutoConnectType": "自動連線目標",