HTTP 407 Proxy Authentication Required — What It Means & How to Fix

HTTP 407 Proxy Authentication Required means the request must be authenticated through a proxy server — the client must present valid proxy credentials.

What It Means

The HTTP 407 Proxy Authentication Required status code is similar to 401 Unauthorized, but specifically for proxy-level authentication. When a client’s request reaches a proxy server (forward proxy or reverse proxy), and that proxy requires authentication before forwarding the request to the destination, the proxy returns 407.

The response includes a Proxy-Authenticate header specifying the authentication scheme required. Common schemes include:

• Basic — username and password sent in plain text (Base64 encoded)
• Digest — challenge-response with hashed credentials
• NTLM — Windows-integrated authentication
• Negotiate — Kerberos-based authentication

The client must respond by re-sending the request with a Proxy-Authorization header containing the appropriate credentials. Unlike 401 where the destination server challenges the client, 407 is the proxy itself challenging the client — the destination server may never even see the request.

When It’s Sent

• Corporate proxy — a company’s forward proxy requires authentication for internet access
• Authenticated CDN — a CDN or reverse proxy requires authentication before forwarding to the origin
• ISP proxy — some internet service providers authenticate users through proxy credentials
• Parental control proxy — a filtering proxy that requires authentication to bypass restrictions
• API gateway — a gateway proxy that authenticates all incoming requests before routing

Real Example

curl -v --proxy http://proxy.example.com:3128 \
  https://api.example.com/data

Expected response:

> GET https://api.example.com/data HTTP/1.1
> Host: api.example.com
>
< HTTP/1.1 407 Proxy Authentication Required
< Proxy-Authenticate: Basic realm="Corporate Proxy"
< Content-Length: 0
<

To authenticate, add the proxy credentials:

curl -v --proxy http://proxy.example.com:3128 \
  --proxy-user "username:password" \
  https://api.example.com/data

Expected authenticated response:

> GET https://api.example.com/data HTTP/1.1
> Host: api.example.com
> Proxy-Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
>
< HTTP/1.1 200 OK
< Content-Type: application/json
< Content-Length: 45
<
{"message":"Authenticated successfully via proxy"}

How to Debug

Client-Side

1. Check proxy configuration — verify the proxy URL, port, and authentication credentials
2. Test without the proxy — bypass the proxy to confirm the issue is proxy-related, not destination-related
3. Verify credentials — check for typos, expired passwords, or changed authentication schemes
4. Check proxy settings in your OS — system-wide proxy settings may override application settings
5. Use environment variables — many tools respect HTTP_PROXY, HTTPS_PROXY, and NO_PROXY

Server-Side

1. Check proxy logs — look for authentication failures and rejected requests
2. Verify proxy authentication backend — ensure the LDAP, Active Directory, or local user database is accessible
3. Test with a known-good credential — confirm the authentication system is working
4. Review realm configuration — the Proxy-Authenticate realm should match expected values
5. Check proxy access controls — verify the proxy is configured to allow the requested destination

curl

# Test proxy without authentication
curl -v --proxy http://proxy:3128 https://example.com

# Test with authentication
curl -v --proxy http://proxy:3128 \
  --proxy-user "user:pass" https://example.com

# Use environment variables (more secure for scripts)
export HTTP_PROXY="http://user:pass@proxy:3128"
export HTTPS_PROXY="http://user:pass@proxy:3128"
curl -v https://example.com

Browser

1. Go to browser proxy settings (Chrome: Settings → System → Open proxy settings)
2. Enter the proxy address and port
3. If the proxy requires authentication, the browser will prompt for credentials
4. Check for proxy configuration scripts (PAC files) that may be set by your organization

Common Causes

FAQ

Related Codes

• HTTP 401 Unauthorized — destination server requires authentication
• HTTP 403 Forbidden — authenticated but not authorized to access the resource
• HTTP 502 Bad Gateway — proxy cannot reach the upstream server
• HTTP 504 Gateway Timeout — proxy timed out waiting for the upstream server