HTTP 511 Network Authentication Required

HTTP 511 is Network Authentication Required: the client needs to authenticate to gain network access (RFC 6585 section 6). It’s for captive portals, the hotel, airport and café networks that intercept traffic until you sign in or accept terms. Origin servers shouldn’t send it; it belongs to the intercepting proxies that control access to the network. Caches must not store it.

Why it exists

A captive portal answers requests meant for other sites. When it does that with a redirect to its login page, or a 200 with its own HTML, a program that isn’t a browser, such as an app’s API call, a package manager or an update check, takes the portal’s page for the real server’s answer. A 511 says plainly that the response came from the network, not from the site that was asked.

The response

RFC 6585’s example:

HTTP/1.1 511 Network Authentication Required
Content-Type: text/html

<html>
   <head>
      <title>Network Authentication Required</title>
      <meta http-equiv="refresh"
            content="0; url=https://login.example.net/">
   </head>
   <body>
      <p>You need to <a href="https://login.example.net/">
      authenticate with the local network</a> in order to gain
      access.</p>
   </body>
</html>

The page links to the login server instead of containing the form: a browser shows the 511 under the URL the user asked for, and a login form there would look as if it belonged to that site. For the same reason RFC 6585 says a 511 shouldn’t carry a WWW-Authenticate challenge.

Only on plain HTTP

A portal can intercept only unencrypted HTTP; for an HTTPS site it can’t present a valid certificate, so the browser shows a certificate or connection error instead of any status. That’s why devices check for portals with plain-HTTP probes, such as Apple’s http://captive.apple.com/hotspot-detect.html, Android’s http://connectivitycheck.gstatic.com/generate_204 and Windows’ http://www.msftconnecttest.com/connecttest.txt, and treat any unexpected answer as a portal. RFC 8910 and RFC 8908 add a cleaner route: the network announces a captive-portal API through DHCP or router advertisements, and the device asks it directly.

511, 401 or 407

the network wants you to sign in         511, from a captive portal
this site wants credentials              401, with WWW-Authenticate
a configured proxy wants credentials     407, with Proxy-Authenticate

In an app

An unexpected 511 means the device is behind a portal, not that your server or the user’s session has a problem. Tell the user to open a browser and sign in to the network, don’t retry in a tight loop, and don’t sign the user out of your app.

Search 401 407 511 in the tool below to compare the three.