So, I analyzed the error and I think I found the problem. (urllib.request - Python 3.5.0)

It all starts with l. 1079, as the 407 error gets handled, everything ok here, in l. 1081 http_error_auth_reqed(...) gets executed.

So next, we are in l. 939, also everything correct here, retry_http_digest_auth gets executed in l. 953. (woops, "http_digest_auth"?!, nah, let's see what comes next)

So we are in l. 953 and follow the code to come to the get_authorization(...) call.

Now we are in l. 981, and in that part of the code lies the problem.
To get the username and password for the proxy, the function find_user_password(realm, req.full_url) gets executed.

An example, if my proxy has the address abc.com:8080 and my request is for xyz.com, the function tries to find a password for the xyz.com url, instead of the abc.com:8080 url. So it can't find a password and the whole auth process stops with the 407 error.

But if you just change the line, to use the host, normal http digest auth doesn't work anymore, I would suggest?

So it's also obvious why the workaround of toobaz works.

--------------------------------------------------------

To solve the Problem, two auth handler would be needed, one for the proxy and one for normal http auth.
Two different handlers were used in the basic auth, so I think it would be an consistent solution?