407 Proxy Authentication Required

Meaning & Description

The 407 Proxy Authentication Required status code is similar to 401 Unauthorized, but it indicates that the client must first authenticate itself with a proxy server that sits between the client and the destination server.

Common Causes

Missing `Proxy-Authorization` header in the request
Invalid or expired proxy credentials
Misconfigured network settings in the operating system or browser

How to fix a 407 error

Check the `Proxy-Authenticate` response header to see what type of authentication the proxy expects.
Ensure your HTTP client is configured to send the `Proxy-Authorization` header.
Verify that your proxy username and password are correct.
If using curl, ensure you are using the `-U` or `--proxy-user` flag.

Browser & SEO Behaviour

Browser Behavior

Browsers will natively pop up a login dialog asking the user to enter a username and password for the proxy, identical to how they handle a 401 Basic Auth challenge.

SEO Impact

Crawlers do not use authenticated proxies to access public sites, so they will not encounter this code.

CDN Behavior

Not cached. CDNs typically act as reverse proxies, while 407 is usually issued by forward proxies.

Code Examples

Node.js (http)

const http = require('http');

const server = http.createServer((req, res) => {
  const proxyAuth = req.headers['proxy-authorization'];
  if (!proxyAuth) {
    res.writeHead(407, {
      'Proxy-Authenticate': 'Basic realm="Proxy Gateway"'
    });
    return res.end('Proxy Authentication Required');
  }
  // Proceed with proxying the request...
  res.end('Proxied successfully');
});
server.listen(8080);

Python (Requests)

# This shows the client side handling of a proxy
import requests

proxies = {
    'http': 'http://user:pass@10.10.1.10:3128',
    'https': 'http://user:pass@10.10.1.10:1080',
}

# If the proxy credentials are wrong, requests will raise a 407 error
response = requests.get('http://example.org', proxies=proxies)

Go (net/http)

func proxyHandler(w http.ResponseWriter, r *http.Request) {
    auth := r.Header.Get("Proxy-Authorization")
    if auth == "" {
        w.Header().Set("Proxy-Authenticate", `Basic realm="MyProxy"`)
        http.Error(w, "Proxy Auth Required", http.StatusProxyAuthRequired)
        return
    }
    // Handle proxying
}

C# (HttpClient)

var proxy = new WebProxy("http://proxy.example.com:8080")
{
    Credentials = new NetworkCredential("user", "pass")
};
var handler = new HttpClientHandler { Proxy = proxy };
var client = new HttpClient(handler);
// Without credentials, the proxy returns 407

curl

curl -i -x http://proxy.example.com:8080 http://example.com
# Returns 407. Fix by adding -U user:pass
# curl -x http://proxy.example.com:8080 -U user:pass http://example.com

Raw HTTP Response Example

HTTP Response

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="Corporate Proxy"
Content-Type: text/html
Content-Length: 153

<html>
<head><title>407 Proxy Authentication Required</title></head>
<body>
<h1>Proxy Authentication Required</h1>
</body>
</html>

Real-world Examples

Squid Proxy: Returns 407 when configured to require user login before allowing outbound internet access.

Bright Data / Luminati: Returns 407 if you fail to provide valid credentials for their residential proxy network.

Corporate Firewalls: Enterprise networks often return 407 to enforce employee web filtering policies.

Frequently Asked Questions

What is the difference between 401 and 407?

401 is returned by the destination server you are trying to reach. 407 is returned by a proxy server sitting between you and the destination.

Which header should I use to authenticate with a proxy?

You must use the `Proxy-Authorization` header, not the standard `Authorization` header.

How do I pass proxy credentials in curl?

Use the `-U` or `--proxy-user` flag, for example: `curl -x proxy:8080 -U username:password http://example.com`.

Why does my browser ask for a password randomly?

Your computer or network might be configured to route traffic through a corporate proxy that requires authentication, triggering a 407 response which the browser shows as a login prompt.

Can an API gateway return a 407?

Technically yes, if it acts as a proxy, but it is much more common for API gateways to return 401 Unauthorized.

Did You Know?

407 is one of the few HTTP status codes explicitly designed for middleboxes (proxies) rather than the origin server or the end client.

Because it intercepts traffic, proxy authentication is often considered a legacy pattern, largely replaced by zero-trust network architectures.

Developer Tips

If you are building a microservices architecture, do not use 407 for service-to-service authentication; stick to 401.
When debugging network requests in code, ensure your HTTP client library actually supports proxy authentication, as some require specific configuration to forward the `Proxy-Authorization` header.
Always mandate HTTPS for connections to your proxy if you are using Basic authentication to prevent credential sniffing.

Interview Questions

These are questions you might face in a backend or API design interview that touch on HTTP 407.

Explain the difference between 401 and 407.

401 Unauthorized means the destination server rejected the request due to missing credentials. 407 Proxy Authentication Required means an intermediary proxy server intercepted the request and requires authentication before it will forward the request to the destination.

Which HTTP headers are associated with a 407 status code?

The proxy server sends a `Proxy-Authenticate` header in the response, and the client must retry the request with a `Proxy-Authorization` header.

Is 407 commonly used in modern REST APIs?

No, it is almost exclusively used by forward proxies (like Squid or corporate firewalls). REST APIs use 401 or 403.

Common Interview Mistakes

Confusing 407 with 401 Unauthorized.
Believing 407 is used for Reverse Proxies (Reverse proxies typically use 401/403 or 502/504 for errors).