Send a Complete HTTP 407 Proxy Authentication Response
Send a complete HTTP/1.1 407 response with its challenge, header terminator and explicit zero-length body.
A client cannot act on a proxy’s authentication challenge until it has a complete HTTP response to parse. A status line and a Proxy-Authenticate field still need the blank line that ends the header section.
A minimal HTTP/1.1 response with no body has this structure:
HTTP/1.1 407 Proxy Authentication Required<CRLF>
Proxy-Authenticate: Basic realm="local-proxy"<CRLF>
Content-Length: 0<CRLF>
<CRLF>Each CRLF marker represents carriage-return and line-feed bytes, not literal marker text. The final header line already ends with CRLF; the additional CRLF creates the empty line. Content-Length states that no body follows.
Send or flush the complete response before waiting for another request. On a raw socket, also account for writes that send fewer bytes than requested.
A 407 requires at least one applicable Proxy-Authenticate challenge. If the client supports the offered scheme and obtains credentials, it can retry with Proxy-Authorization. A website’s 401 and WWW-Authenticate fields concern a different hop.
This Basic challenge is a framing example, not a complete authentication design. Basic credentials need a protected connection when confidentiality matters. Sending the challenge also does not implement password validation, request parsing or CONNECT tunnelling.