HTTP 511 Network Authentication Required – Free, Online, Private

What HTTP 511 means

511 tells the client that it must authenticate to the network before the origin will be reachable. Captive portals send it when they intercept traffic. The response should not claim to be the origin. A client that receives 511 for a URL it knows should not treat the body as that URL's content. RFC 6585 defines the status. The usual follow-up is to open the portal login, not to retry the API call with an Authorization header.

511 Network Authentication Required belongs to the 5xx server error class. Clients that only look at the class will group it with its neighbors. Clients that care about the exact code should use the narrower rule on this page, because the class is only the first digit.

When you see HTTP 511

When you see HTTP 511 Network Authentication Required, stop on that exact status line. 511 Network Authentication Required means a captive portal wants the client to authenticate to the network. The trace that usually produces it: A hotel or airport portal intercepted the request. The 5xx server error class only tells you the first digit. A neighbor in that class is a different fault, and the fix on this page does not transfer to it.

A network interceptor returns 511 to tell the client to authenticate to the network. Origins should not return 511 for their own login. That is 401. If you operate a captive portal, 511 is the status that lets clients distinguish the portal from the site the user asked for. The body should link to the login page.

How to fix HTTP 511

To fix HTTP 511, change the condition that made the server choose Network Authentication Required. Open the portal authentication. Do not treat the body as the origin response. Do not attach the origin's Authorization header to the portal request. After the network login, retry the original request. After the user authenticates to the network, retry the original URL. Retrying before that returns 511 again. If the log line is a different code, leave this page. The mix-up people make with 511 is this one: 401 is the origin asking for credentials. 407 is a proxy asking for credentials. 511 is the network, often a captive portal, asking the user to sign in before any origin is reachable.

• A client stored the portal's HTML as if it were the origin's homepage.
• An API client treated 511 as 401 and attached the user's API token to the portal.
• The portal returned 200 with a login page, so the client thought the origin had changed its content.

An access log that only stores 511 is not enough to tell these apart. Keep the method, the path, and a request id. Do not keep the Authorization header or a request body that might be a token. The status explains the outcome. It is not a place to echo secrets back to the client either.

Example response

HTTP 511 Network Authentication RequiredHTTP/1.1 511 Network Authentication Required
Content-Type: text/html

The HTML links to the network login. The client should present that login and then retry the original URL, which will finally reach the origin. An API client that cannot log a human into a portal should fail with a network error, not with an application error. Do not send your API credentials to the host that returned 511.

What the client should do

Open the portal authentication. Do not treat the body as the origin response. Do not attach the origin's Authorization header to the portal request. After the network login, retry the original request.

Never cache 511 as the origin's representation. A cached portal page served later, off the network, is a nasty bug.

After the user authenticates to the network, retry the original URL. Retrying before that returns 511 again.

Codes people confuse with HTTP 511

401 is the origin asking for credentials. 407 is a proxy asking for credentials. 511 is the network, often a captive portal, asking the user to sign in before any origin is reachable.