Proxy Authentication Required

Overview

407 Proxy Authentication Required means you must authenticate with an intermediate proxy before the request can proceed. Unlike 401, which asks for authentication to the origin server, 407 is the proxy between client and server demanding credentials.

By spec a 407 response includes a Proxy-Authenticate header stating which scheme the proxy wants, and the client must reply with credentials in a Proxy-Authorization header.

When it happens

• It is returned when you try to reach the internet through a corporate authenticating proxy without providing proxy login details.
• It occurs when proxy credentials are expired or wrong and the proxy refuses to pass the request.

Request / Response example

GET http://example.com/ HTTP/1.1
Host: example.com
(sent through a corporate proxy without credentials)

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="Corporate Proxy"
Content-Type: text/html

<h1>Proxy Authentication Required</h1>

In code

curl -x http://proxy.corp:8080 \
     --proxy-user alice:secret \
     http://example.com/

Notes

• 407 is sent by the proxy, not the origin server, and it uses Proxy-Authenticate/Proxy-Authorization rather than 401's WWW-Authenticate/Authorization.
• In curl you can handle proxy auth with -x to set the proxy and --proxy-user for credentials.
• If the OS/browser system proxy settings store the credentials, the request may pass transparently without a visible 407.

Related status codes

Related headers

Specification