Multiple 407 Status Codes when reviewing a Client-Side Capture

 

When looking at a Client-Side capture (either with Fidddler2 or with RealiTea Viewer), at some sites we see the client is making multiple requests for a page, or resource. The sequence is

1. Request for /resource.do
2. Response Status Code 407
3. Request for /resource.do
4. Response Status Code 407
5. Request for /resource.do
6. Response code 200 (and the page is returned)

 

This pattern indicates that there is a proxy between the client and the web server, and the proxy is configured to use a Challenge/Response Authentication scheme. Here are some additional details for that same sequence above:

1. Request for /resource.do
• The browser sends no authentication headers in this request
2. Response Status Code 407
• The proxy responds with a “Proxy Authentication Required” Status code and also tell the web server what kind of authentication is requried, eitehr basic or Challenge/Response
3. Request for /resource.do
• The browser sends the request again, this time with a HTTP header that tells the proxy it wants to use Challenge/Response
4. Response Status Code 407
• The proxy responds with the 407 status code, and additional it includes the Challenge information
5. Request for /resource.do
• The browser sends the request again, this time with a HTTP header that includes the Response to the Challenge
• The proxy lets this request through to the web server
6. Response code 200 (and the page is returned
• The server returns the response to the proxy, which passes it back to the browser.

 

This article by MSDN has further details and  nice explanation http://msdn.microsoft.com/en-us/library/windows/desktop/aa383144(v=vs.85).aspx