3.3.5.2.3 Status codes: 401 (Unauthorized) and 407 (ProxyAuthentication Required)

HTTP status code values of 401 (Unauthorized) or 407 (Proxy Authentication Required)

indicate that the proxy requires the client to authenticate. Common authentication schemes include Basic and Digest, as specified in [RFC2617], and Negotiated or NTLM HTTP Authentication, as specified in [RFC4559].

The client sets the ProxyAuthRequired state variable to TRUE. Subsequent connection attempts to the same proxy SHOULD avoid the proxy challenge message by sending the proxy authentication credentials as part of the KeepAlive-GET-Request.

Depending on the authentication method, multiple round trips can happen to complete the authentication process. That is, the client MUST expect to get multiple 401 and 407 messages. It MUST follow [RFC2617] and [RFC4559] to set proper authentication headers and retry the proxy connection.

For processing required to retry the proxy connection, see section 3.3.4.1.2.

The ConnectionEstablishment timer SHOULD be reset before re-attempting the KeepAlive handshake (see section 3.3.4.1).