511 Network Authentication Required
This is an educational reference page about HTTP 511 Network Authentication Required. The page itself is served as 200 OK so it can be indexed as HTTP documentation.
The client needs to authenticate to gain network access. Intended for use by intercepting proxies used to control access to the network (e.g., "captive portals" used to require agreement to Terms of Service before granting full Internet access via a Wi-Fi hotspot).
Specification
Registered in the IANA HTTP Status Code Registry as Network Authentication Required. Defined in RFC 6585, Section 6.
Header and content rules
What RFC 6585 says about a 511 response, quoted from the RFC. The 5xx class rules also apply.
- SHOULD (intercepting proxy; content): Link to a resource where the user can submit credentials. Table row
The response representation SHOULD contain a link to a resource that allows the user to submit credentials (e.g., with an HTML form). RFC 6585 §6
- SHOULD NOT (intercepting proxy; content): Do not include a challenge or the login interface itself. Table row
Note that the 511 response SHOULD NOT contain a challenge or the login interface itself, because browsers would show the login interface as being associated with the originally requested URL, which may cause confusion. RFC 6585 §6
- SHOULD NOT (origin server; response): Do not generate 511. It is for intercepting proxies that control network access. Table row
The 511 status SHOULD NOT be generated by origin servers; it is intended for use by intercepting proxies that are interposed as a means of controlling access to the network. RFC 6585 §6
- MUST NOT (cache; storage): Do not store the response. Table row
Responses with the 511 status code MUST NOT be stored by a cache. RFC 6585 §6
The same rules are in the response obligations table and its JSON.