407
Client Error
407 Proxy Authentication Required: Authenticating with a Proxy
✦ The Golden Answer: The 407 Proxy Authentication Required status code means the client must authenticate with a proxy server before the proxy can forward the request to the origin server. The proxy responds with a
Proxy-Authenticate header specifying the required authentication scheme (e.g., Basic, Digest). The client must resend the request with a Proxy-Authorization header containing valid credentials. This is similar to 401, but for proxies instead of the origin server.
How Proxy Authentication Works
- Client sends a request to a proxy without authentication.
- Proxy responds with 407 Proxy Authentication Required and a
Proxy-Authenticateheader. - Client sends a new request with a
Proxy-Authorizationheader containing credentials. - If credentials are valid, the proxy forwards the request to the origin server and returns the response.
Example: Proxy Authentication Flow
| Step | Direction | HTTP Message |
|---|---|---|
| 1 | Client → Proxy | GET / HTTP/1.1 |
| 2 | Proxy → Client | HTTP/1.1 407 Proxy Authentication Required |
| 3 | Client → Proxy | GET / HTTP/1.1 |
| 4 | Proxy → Client | HTTP/1.1 200 OK |
Proxy-Authenticate vs. WWW-Authenticate
| Header | Used By | Purpose |
|---|---|---|
| Proxy-Authenticate | Proxy server | Specifies the authentication scheme required by the proxy. |
| WWW-Authenticate | Origin server | Specifies the authentication scheme required by the origin server (401 response). |
Common Proxy Authentication Schemes
- Basic – sends username and password encoded in Base64. Insecure over HTTP, but common for internal networks.
- Digest – more secure, uses a challenge‑response handshake.
- Negotiate – used for Kerberos/SPNEGO in enterprise environments.
- NTLM – Microsoft's proprietary authentication protocol.
How to Fix 407 Errors
- If you're a client user: Configure your browser or application with the proxy credentials. In browsers, go to network/proxy settings and enter the username and password. For applications, set the proxy environment variables (e.g.,
HTTP_PROXY,HTTPS_PROXY) with credentials. - If you're a developer: When making HTTP requests, include the
Proxy-Authorizationheader when you know the proxy requires authentication. Many HTTP libraries support proxy authentication via options or environment variables. - If you control the proxy: Verify the authentication configuration. Ensure the proxy is properly set up with a user database (e.g., LDAP, local users).
407 vs. 401
- 401 Unauthorized – client needs to authenticate with the origin server.
- 407 Proxy Authentication Required – client needs to authenticate with the proxy server.
Both are client errors, but they target different entities in the request chain.
Frequently Asked Questions
Is 407 a server error or a client error?
It's a client error (4xx) because the client failed to provide proxy authentication. However, the proxy is the one enforcing the authentication.
Can I bypass proxy authentication?
No, if the proxy requires authentication, you must provide valid credentials. You cannot bypass it unless you use a different proxy or no proxy at all.
Why do I get a 407 even though I'm already authenticated?
Your credentials may have expired, or the proxy may require a different authentication scheme. Check your proxy settings and try re‑entering your credentials.