Proxy authentication is the check a proxy server runs to confirm that a client is allowed to use it before it forwards any traffic. The client proves who it is with credentials, such as a username and password, or by connecting from an approved IP address. If the check fails, the proxy refuses the request. Over HTTP, that refusal is a 407 status code.

Username/Password vs. IP Whitelisting

  • Username/password authentication works from any device or network, which makes it useful for rotating environments like cloud servers with changing IPs.
  • IP whitelisting authorizes specific source IPs without requiring credentials in the code, which is simpler to set up but breaks if your own IP changes.

Many providers support both and let customers choose per use case, so the right method usually comes down to whether your own source IP is stable.

How the 407 Challenge Works

  • Challenge: A proxy that needs credentials answers an unauthenticated request with 407 Proxy Authentication Required. The response must include a Proxy-Authenticate header that names the scheme to use, such as Basic.
  • Retry: The client repeats the request with a Proxy-Authorization header that carries its credentials, for example Proxy-Authorization: Basic <credentials>.
  • 407 vs. 401: A 407 works like a 401 Unauthorized, but it means the proxy needs credentials, not the website.
  • Scope: Proxy-Authorization applies only to the proxy that asked for it. In a chain of proxies, the first proxy that expects credentials consumes the header.

Keeping Proxy Credentials Secure

  • Basic is not encryption: The Basic scheme only base64-encodes username:password. Base64 is reversible, so this is equivalent to sending the credentials in clear text.
  • Prefer encrypted connections: MDN recommends HTTPS whenever authentication is used, and especially with Basic. Some clients, such as curl, can connect to the proxy itself over TLS with an https:// proxy URL.
  • Encode special characters: curl URL-decodes the username and password in a proxy string, so a password containing @ must be written as %40 and a colon as %3a.