Proxy-Authorization: credentials for the proxy itself
Proxy-Authorization carries credentials for the next proxy rather than for the target server. It answers a 407 challenge and is consumed by that proxy.
At a glance
- Direction
- Request only, addressed to the next hop rather than to the origin.
- Defined in
- RFC 9110
- When absent
- A proxy requiring authentication answers 407 Proxy Authentication Required with its own challenge.
- Challenged by
- Proxy-Authenticate on a 407 response
- Scope
- Hop by hop. The proxy consumes it and does not forward it.
- Status pairing
- 407 for the proxy, 401 for the origin server. They are different problems.
- Tunnels
- Sent on the CONNECT request itself, before the tunnel is established
In detail
The distinction from Authorization is who the credential is for. This header authenticates you to an intermediary standing between you and the destination, typically a corporate egress proxy. The proxy strips it before forwarding, so the origin server never sees it and cannot use it, which is what hop by hop means in practice.
The status codes are deliberately separate. A 407 comes from the proxy and says the proxy will not carry your request; a 401 comes from the origin and says the resource needs credentials. Confusing them sends people to reset an application password when the real problem is an expired proxy credential on their machine.
For an HTTPS destination through a proxy, the exchange happens on the CONNECT request that sets up the tunnel, before any encrypted bytes flow. The proxy authenticates the tunnel and then relays opaque data, which is why a proxy can gate access to a site it cannot read the contents of.
In automation, this is what a proxy URL containing a user name and password becomes. Environment variables understood by most command line tools accept that form and turn it into this header, which also means those credentials end up in shell history and process listings unless you are careful about where the variable is set.
Schemes are the same registry the origin side uses, so Basic and Digest both appear here, and a proxy may offer several in its challenge. Where a corporate proxy uses a scheme your client does not implement, the request fails at the proxy with a 407 that repeats forever, which is why a tool that works in a browser can be unusable from a script on the same machine.
Examples
HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="corp-egress"
CONNECT api.example.com:443 HTTP/1.1
Proxy-Authorization: Basic YWxpY2U6czNjcmV0export HTTPS_PROXY=http://alice:s3cret@proxy.corp.example:3128The client turns the credentials in the URL into a Proxy-Authorization header on the CONNECT request.
Things that catch people out
- Sending origin credentials in this header authenticates you to the proxy and never reaches the application, so the request arrives anonymous.
- The header is hop by hop and is not forwarded, so debugging it from the origin server's logs is impossible: it was never there.
- Proxy credentials embedded in an environment variable are visible in process listings and shell history on shared machines.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Authorization: credentials on a request
How the Authorization header is structured, how Basic and Bearer differ, why it is dropped across a cross-host redirect, and how it interacts with caching.
WWW-Authenticate: the challenge that comes with a 401
What a 401 challenge must contain, what realm means to a browser, how Bearer error codes are reported, and why a 401 without this header is malformed.
Via: the proxies a message passed through
How Via records each intermediary, what the protocol and pseudonym fields mean, how it detects request loops, and why it is useful when debugging a cache.
Connection: keep-alive, close and hop by hop headers
What the Connection header controls, how it lists hop by hop headers, why HTTP/1.1 keeps connections open by default, and why HTTP/2 forbids it.
Cookie: what the browser sends back
How the Cookie header is formatted, why attributes never come back, how the browser decides which cookies to include, and what the size limits are.
Set-Cookie: attributes, SameSite and cookie prefixes
Every Set-Cookie attribute explained, why SameSite=None needs Secure, what the __Host- prefix guarantees, and how Max-Age and Expires interact.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL