511 Network Authentication Required
The client must authenticate with the network itself, typically a captive portal on public Wi-Fi.
Status
HTTP/1.1 511 Network Authentication Required
Details
- Category: 5xx
- Status: Standard. Registered with IANA and defined by a current standards-track RFC.
- Specification: RFC 6585 §6
- Cacheable: Not cacheable
- Response body: Allowed
- Retry: Retry only after changing the request
511 exists so captive portals stop lying. Before it, a hotel or airport network would intercept a request and return 200 with a login page, which corrupted caches and confused clients that had asked for something else entirely. 511 states plainly that the network, not the origin, is intercepting.
The response is generated by an intermediary and should not be cached. Operating systems use it as one of the signals that a network requires sign-in.
Note: 511 comes from the network you are on, not from the site you requested. Proxy authentication failures are 407 instead.
Headers
- Location: Often points at the portal's login page, though the specification does not require it.
Common causes
- A captive portal on public Wi-Fi requiring sign-in or terms acceptance.
- A corporate network gateway requiring authentication before external access.
- A network access control system quarantining an unrecognized device.
How to fix it
As the client
- Complete the portal login in a browser, then retry the original request.
- In automation, treat 511 as an environment problem rather than an application error: the request never left the network.
As the server
- Portal operators should return 511 rather than intercepting with a 200, which poisons caches and breaks non-browser clients.
- Mark the response no-store so the login page is never cached as the resource that was requested.
Examples
A captive portal intercepting a request
HTTP request
GET /api/status HTTP/1.1 Host: api.example.com
HTTP response
HTTP/1.1 511 Network Authentication Required Content-Type: text/html; charset=utf-8 <a href="https://wifi.example.net/login">Sign in to use this network</a>
Notes for proxy users
A 511 while using a proxy means your own network is intercepting traffic before it reaches the proxy. It is not a proxy authentication problem: that is 407. Clear the portal first, then retry.