HTTP 407 Proxy Authentication Required
ID: networking/proxy-authentication-required
Version Compatibility
| Version | Status | Introduced | Deprecated | Notes |
|---|---|---|---|---|
| any | active | — | — | — |
Root Cause
An HTTP proxy server requires authentication before forwarding the request. The client must provide valid credentials via the Proxy-Authorization header using the authentication scheme specified in the proxy's Proxy-Authenticate response header.
genericWorkarounds
-
90% success Configure proxy credentials in the client application or environment
1. Identify the proxy URL and authentication scheme from the 407 response headers 2. Set environment variables: export HTTP_PROXY=http://user:pass@proxy:port export HTTPS_PROXY=http://user:pass@proxy:port 3. For curl: curl -x http://proxy:port -U user:pass https://target.com 4. For Python requests: proxies = {'http': 'http://user:pass@proxy:port', 'https': 'http://user:pass@proxy:port'} 5. For npm: npm config set proxy http://user:pass@proxy:port 6. For git: git config --global http.proxy http://user:pass@proxy:port -
85% success Use NTLM or Kerberos proxy authentication with a local proxy relay
1. If the proxy requires NTLM/Kerberos (common in corporate environments), use a local proxy relay 2. Install cntlm: apt install cntlm 3. Configure cntlm with your domain credentials: edit /etc/cntlm.conf 4. Run cntlm: cntlm -v -c /etc/cntlm.conf 5. Point applications to cntlm's local port: export HTTP_PROXY=http://localhost:3128 6. cntlm handles NTLM negotiation transparently
Dead Ends
Common approaches that don't work:
-
Bypass the proxy by hardcoding IP addresses to avoid DNS-based proxy routing
80% fail
Corporate proxies typically operate at the network level (transparent proxy, WPAD, or mandatory routing). Hardcoding IPs does not bypass the proxy if traffic is routed through it at the network layer. Additionally, this breaks when IPs change and may violate corporate security policies.
-
Set the standard Authorization header instead of Proxy-Authorization
95% fail
The Authorization header authenticates with the origin server, not the proxy. Proxy servers specifically require the Proxy-Authorization header. Using the wrong header means the proxy never sees the credentials and continues returning 407.