topic
Verified 2026-09-18

WWW-Authenticate and Proxy-Authenticate

Challenge fields tell a client which authentication scheme and protection space apply.

WWW-Authenticate challenges an origin request after 401. Proxy-Authenticate challenges proxy access after 407. The scheme and parameters depend on the authentication method.

httpauthproxyheader

Reference (http)

WWW-Authenticate: Basic realm="staging"
Proxy-Authenticate: Basic realm="proxy"

WWW-Authenticate challenges an origin request after 401. Proxy-Authenticate challenges proxy access after 407. The scheme and parameters depend on the authentication method.

Common mistakes

  • Assuming the realm encrypts credentials or treating a Basic challenge as safe without TLS.

Sources

Permalink: https://merginit.com/reference/http/www-authenticate