Proxy credentials not configured in Git settings Proxy password contains special characters that aren't URL-encoded Wrong proxy authentication method (Basic vs NTLM vs Negotiate)

Is the "407" error serious?

It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

How to fix fatal: unable to access: Received HTTP code 407 from proxy after CONNECT in Git

GitINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 285 views

The HTTP 407 error occurs when Git cannot authenticate with a proxy server that requires credentials. This typically happens in corporate environments where network traffic must pass through an authenticated proxy, and Git hasn't been configured with the correct proxy credentials or authentication method.

Quick fix

Fixes 407

# Set HTTP proxy
git config --global http.proxy http://username:password@proxy.company.com:8080

# Set HTTPS proxy (often same as HTTP proxy)
git config --global https.proxy http://username:password@proxy.company.com:8080

Configure Git proxy with credentials
Set the proxy authentication method
Use CNTLM for NTLM proxy authentication
Set proxy using environment variables

git — error

$# Set HTTP proxy
git config --global http.proxy http://username:password@proxy.company.com:8080
# Set HTTPS proxy (often same as HTTP proxy)
git config --global https.proxy http://username:password@proxy.company.com:8080
fatal: unable to access: Received HTTP code 407 from proxy after CONNECT

What this error means

This error indicates that Git attempted to connect to a remote repository (like GitHub, GitLab, or Bitbucket), but the connection was blocked by an intermediary proxy server that requires authentication. The "407 Proxy Authentication Required" HTTP status code is returned when the proxy needs valid credentials before it will forward your request. In corporate and enterprise environments, network administrators often require all outbound HTTP/HTTPS traffic to pass through a proxy server. This allows the organization to monitor traffic, enforce security policies, and cache frequently accessed content. When the proxy requires authentication, Git must provide valid credentials to the proxy before it can reach the actual Git remote server. The authentication flow works like this: 1. Git tries to connect to the remote repository (e.g., github.com) 2. The request is intercepted by the corporate proxy server 3. The proxy requires authentication and returns HTTP 407 4. Git must provide proxy credentials to proceed 5. Once authenticated with the proxy, the request is forwarded to the actual destination This is separate from repository authentication - you need to authenticate with the proxy first, then potentially authenticate with the Git remote server as well.

Typical symptoms

Git clone, push, pull, or fetch fails with 'HTTP code 407' error
Error message contains 'Received HTTP code 407 from proxy after CONNECT'
Git operations work on home network but fail at office
Commands fail only for HTTPS remotes, not for SSH
Error appears after company password change or proxy configuration update
Browser can access GitHub but Git commands fail
CI/CD pipelines fail when running behind corporate proxy
Same credentials work in browser but not in Git

Common causes

Proxy credentials not configured in Git settings
Proxy password contains special characters that aren't URL-encoded
Wrong proxy authentication method (Basic vs NTLM vs Negotiate)
Corporate proxy requires domain prefix (DOMAIN\username)
Cached proxy credentials have expired or password changed
Environment variables (HTTP_PROXY, HTTPS_PROXY) not set
Git proxy settings point to wrong proxy server address or port
NTLM authentication required but Git not configured to use it
Proxy settings configured for HTTP but not HTTPS
SSL inspection by proxy causes certificate issues alongside auth

How to fix "fatal: unable to access: Received HTTP code 407 from proxy after CONNECT"

1Configure Git proxy with credentials

Set up Git to use your proxy server with authentication credentials. You'll need your proxy server address, port, and credentials:

Basic proxy configuration:

bash

# Set HTTP proxy
git config --global http.proxy http://username:password@proxy.company.com:8080

# Set HTTPS proxy (often same as HTTP proxy)
git config --global https.proxy http://username:password@proxy.company.com:8080

If your company uses a domain (e.g., CORP\username):

bash

# Use backslash for domain - escape it properly
git config --global http.proxy "http://CORP\\username:password@proxy.company.com:8080"

URL encode special characters in password:
If your password contains special characters, you must URL-encode them:
- @ becomes %40
- # becomes %23
- ! becomes %21
- $ becomes %24
- & becomes %26
- \ becomes %5C

bash

# Example: password is "p@ss#word!"
git config --global http.proxy "http://username:p%40ss%23word%21@proxy.company.com:8080"

Verify your settings:

bash

git config --global --get http.proxy
git config --global --get https.proxy

2Set the proxy authentication method

Git defaults to "anyauth" which automatically selects an authentication method. However, this doesn't always work correctly with all proxy types. Explicitly setting the method often resolves 407 errors:

Set Basic authentication:

bash

git config --global http.proxyAuthMethod basic

Available authentication methods:
- anyauth - Auto-detect (default, but sometimes fails)
- basic - HTTP Basic authentication (username:password)
- digest - HTTP Digest authentication (more secure than basic)
- negotiate - Kerberos/SPNEGO authentication
- ntlm - Windows NTLM authentication

For Windows/Active Directory environments:

bash

# Try NTLM if Basic doesn't work
git config --global http.proxyAuthMethod ntlm

Using environment variable override:

bash

# Set for a single command
GIT_HTTP_PROXY_AUTHMETHOD=basic git clone https://github.com/user/repo.git

# Or export for the session
export GIT_HTTP_PROXY_AUTHMETHOD=basic

Note: The http.proxyAuthMethod setting only takes effect when your proxy URL includes a username (the user@host format).

3Use CNTLM for NTLM proxy authentication

Many corporate proxies use NTLM (Windows NT LAN Manager) authentication, which Git doesn't handle well natively. CNTLM is a local proxy that handles NTLM authentication for you:

Install CNTLM:

bash

# On Ubuntu/Debian
sudo apt install cntlm

# On macOS (using Homebrew)
brew install cntlm

# On Windows: Download from https://cntlm.sourceforge.net/

Configure CNTLM (edit /etc/cntlm.conf or cntlm.ini):

ini

Username    your_username
Domain      CORP
Password    your_password
Proxy       proxy.company.com:8080
NoProxy     localhost, 127.0.0.*, 10.*, 192.168.*
Listen      3128

Generate password hash (more secure):

bash

cntlm -H -d CORP -u your_username
# Enter password when prompted
# Copy the output hashes to cntlm.conf

Start CNTLM:

bash

# On Linux
sudo systemctl start cntlm

# On macOS
brew services start cntlm

# On Windows
cntlm -v  # Test first
net start cntlm  # Run as service

Configure Git to use local CNTLM proxy:

bash

git config --global http.proxy http://127.0.0.1:3128
git config --global https.proxy http://127.0.0.1:3128
# No username/password needed - CNTLM handles it

4Set proxy using environment variables

As an alternative to Git config, you can set proxy settings via environment variables. This is useful for CI/CD pipelines or when you want proxy settings to apply to all applications:

Set environment variables:

bash

# For Linux/macOS - add to ~/.bashrc, ~/.zshrc, or ~/.profile
export HTTP_PROXY="http://username:password@proxy.company.com:8080"
export HTTPS_PROXY="http://username:password@proxy.company.com:8080"
export NO_PROXY="localhost,127.0.0.1,.company.com"

# Apply changes
source ~/.bashrc

For Windows (Command Prompt):

cmd

set HTTP_PROXY=http://username:password@proxy.company.com:8080
set HTTPS_PROXY=http://username:password@proxy.company.com:8080
set NO_PROXY=localhost,127.0.0.1,.company.com

For Windows (PowerShell):

powershell

$env:HTTP_PROXY = "http://username:password@proxy.company.com:8080"
$env:HTTPS_PROXY = "http://username:password@proxy.company.com:8080"
$env:NO_PROXY = "localhost,127.0.0.1,.company.com"

# To set permanently:
[System.Environment]::SetEnvironmentVariable("HTTP_PROXY", "http://proxy.company.com:8080", "User")

One-time command execution:

bash

HTTPS_PROXY="http://user:pass@proxy:8080" git clone https://github.com/user/repo.git

Important: Git respects both lowercase and uppercase environment variable names (http_proxy and HTTP_PROXY), but uppercase is more widely compatible.

5Edit .gitconfig file directly

For complex configurations or when command-line encoding is problematic, edit your Git configuration file directly:

Open your global gitconfig:

bash

# Find the location
git config --global --list --show-origin

# Edit directly
git config --global --edit
# Or edit: ~/.gitconfig (Linux/macOS) or C:\Users\USERNAME\.gitconfig (Windows)

Add proxy configuration:

ini

[http]
    proxy = http://DOMAIN\username:password@proxy.company.com:8080
    proxyAuthMethod = basic
    sslVerify = false

[https]
    proxy = http://DOMAIN\username:password@proxy.company.com:8080

Per-repository proxy settings:
You can also set proxy only for specific URLs:

ini

[http "https://github.com"]
    proxy = http://username:password@proxy.company.com:8080
    proxyAuthMethod = basic

[http "https://gitlab.company.com"]
    proxy = ""

Note about sslVerify: Setting sslVerify = false may be necessary if your proxy performs SSL inspection (man-in-the-middle). This is a security trade-off - only disable SSL verification if you understand the implications and trust your network.

6Clear old proxy settings and cached credentials

If you've changed passwords or proxy configurations, old cached settings may interfere:

Remove Git proxy settings:

bash

# Clear global proxy settings
git config --global --unset http.proxy
git config --global --unset https.proxy
git config --global --unset http.proxyAuthMethod

# Clear all http settings
git config --global --remove-section http
git config --global --remove-section https

Check for proxy settings at multiple levels:

bash

# Show all config with origins
git config --list --show-origin | grep -i proxy

# System level (may require admin)
git config --system --unset http.proxy

# Repository level (if set per-repo)
git config --local --unset http.proxy

Clear environment variables:

bash

# For current session
unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy

# Check if set
env | grep -i proxy

Clear credential cache:

bash

# If using credential cache
git credential-cache exit

# If using credential store
rm ~/.git-credentials

After clearing, reconfigure your proxy settings with the correct credentials.

7Handle SSL certificate issues with proxy

Corporate proxies often perform SSL/TLS inspection (man-in-the-middle), which can cause certificate errors alongside or instead of 407 errors:

Add corporate CA certificate to Git:

bash

# Export your company's root CA certificate from your browser
# (usually in Settings > Certificates > Authorities > Export)

# Tell Git to use the certificate
git config --global http.sslCAInfo /path/to/company-ca-cert.pem

# Or append to the existing CA bundle
cat company-ca-cert.pem >> /etc/ssl/certs/ca-certificates.crt

On Windows, export and add certificate:
1. Open Internet Options > Content > Certificates
2. Go to Trusted Root Certification Authorities
3. Find your company's CA certificate
4. Export as "Base-64 encoded X.509 (.CER)"
5. Configure Git:

bash

git config --global http.sslCAInfo "C:\path\to\company-ca-cert.crt"

Disable SSL verification (last resort):

bash

# Not recommended for security reasons
git config --global http.sslVerify false

# Better: disable only for specific hosts
git config --global http."https://internal-git.company.com".sslVerify false

Enable verbose debugging:

bash

GIT_CURL_VERBOSE=1 GIT_TRACE=1 git clone https://github.com/user/repo.git

8Consider switching to SSH instead of HTTPS

If proxy authentication continues to be problematic, consider using SSH for Git operations. Many corporate proxies only inspect HTTP/HTTPS traffic, allowing SSH through:

Check if SSH works through your network:

bash

ssh -T git@github.com
# If this succeeds (or prompts for key), SSH is allowed

Set up SSH key authentication:

bash

# Generate SSH key
ssh-keygen -t ed25519 -C "your_email@company.com"

# Add to SSH agent
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# Copy public key
cat ~/.ssh/id_ed25519.pub
# Add this to your GitHub/GitLab account settings

Change remote from HTTPS to SSH:

bash

# Check current remote
git remote -v

# Change to SSH
git remote set-url origin git@github.com:username/repo.git

If SSH is blocked, try SSH over HTTPS port (GitHub):

bash

# Edit ~/.ssh/config
Host github.com
    Hostname ssh.github.com
    Port 443
    User git

# Test
ssh -T git@github.com

SSH through HTTP proxy (if allowed):

bash

# Add to ~/.ssh/config
Host github.com
    ProxyCommand nc -X connect -x proxy.company.com:8080 %h %p
    # Or for NTLM proxy with corkscrew:
    # ProxyCommand corkscrew proxy.company.com 8080 %h %p

Advanced notes

### Understanding Proxy Authentication Methods

Git (via libcurl) supports several proxy authentication methods:

| Method | Description | Use Case |
|--------|-------------|----------|
| anyauth | Auto-detect (default) | Works when proxy announces supported methods |
| basic | Username:password in Base64 | Simple proxies, but credentials visible |
| digest | Challenge-response hash | More secure than basic |
| ntlm | Windows NTLM protocol | Active Directory environments |
| negotiate | Kerberos/SPNEGO | Enterprise SSO with Kerberos |

The http.proxyAuthMethod setting requires the proxy URL to include a username portion (user@host format) to take effect.

### Debugging Proxy Connections

Enable verbose output to diagnose issues:

bash

# Curl-level debugging
GIT_CURL_VERBOSE=1 git clone https://github.com/user/repo.git

# Git tracing
GIT_TRACE=1 GIT_TRACE_CURL=1 git clone https://github.com/user/repo.git

# Check what authentication method is being used
GIT_TRACE_CURL=1 git clone https://github.com/user/repo.git 2>&1 | grep -i proxy

### Windows-Specific NTLM Issues

On Windows, Git for Windows uses different libcurl builds that may or may not include NTLM support. If native NTLM doesn't work:

1. Use CNTLM as a local proxy (recommended)
2. Try the px proxy tool: https://github.com/genotrance/px
3. Use Git Credential Manager which may handle proxy auth better

### Using px as an Alternative to CNTLM

The px proxy is a modern alternative to CNTLM, written in Python:

bash

# Install
pip install px-proxy

# Run (auto-detects Windows proxy settings)
px

# Configure Git to use px
git config --global http.proxy http://127.0.0.1:3128

px automatically reads Windows proxy settings and handles NTLM authentication.

### PAC Files and Auto-Proxy Detection

Some organizations use PAC (Proxy Auto-Config) files. Git doesn't natively support PAC files, so you need to:

1. Find the actual proxy server URL from the PAC file
2. Configure Git with that direct proxy URL
3. Or use tools like px that handle PAC files

### Multiple Proxy Configurations

For different Git hosts, configure different proxies:

ini

# In ~/.gitconfig
[http "https://github.com"]
    proxy = http://external-proxy.company.com:8080

[http "https://git.internal.company.com"]
    proxy = ""  # No proxy for internal Git

[http "https://gitlab.com"]
    proxy = http://external-proxy.company.com:8080
    proxyAuthMethod = ntlm

### Security Considerations

1. Avoid storing passwords in plain text in .gitconfig or environment variables if possible
2. Use CNTLM with hashed passwords instead of plaintext
3. Consider using credential helpers that integrate with OS keychains
4. If using sslVerify = false, understand you're disabling certificate validation
5. Rotate proxy credentials periodically and update configurations

Frequently asked questions

What does "407" mean?: This error indicates that Git attempted to connect to a remote repository (like GitHub, GitLab, or Bitbucket), but the connection was blocked by an intermediary proxy server that requires authentication. The "407 Proxy Authentication Required" HTTP status code is returned when the proxy needs valid credentials before it will forward your request. In corporate and enterprise environments, network administrators often require all outbound HTTP/HTTPS traffic to pass through a proxy server.
How do I fix "407"?: The HTTP 407 error occurs when Git cannot authenticate with a proxy server that requires credentials. This typically happens in corporate environments where network traffic must pass through an authenticated proxy, and Git hasn't been configured with the correct proxy credentials or authentication method.
What causes "407"?: Proxy credentials not configured in Git settings Proxy password contains special characters that aren't URL-encoded Wrong proxy authentication method (Basic vs NTLM vs Negotiate)
Is the "407" error serious?: It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading

📚Git Official Documentation
💬
Stack Overflow - git returns http error 407 from proxy after CONNECT(Stack Overflow)
💬
Stack Overflow - Git through a Proxy: What is causing the 407 error(Stack Overflow)
💬
Stack Overflow - Configuring Git on Windows to use NTLM proxy(Stack Overflow)
📖
Git Documentation - http.proxy configuration(Official Docs)
📝
Microsoft Learn - Git clone/push fails with proxy
📝
CNTLM - Authenticating HTTP proxy for NTLM

How to fix fatal: unable to access: Received HTTP code 407 from proxy after CONNECT in Git

Quick fix

What this error means

Typical symptoms

Common causes

How to fix "fatal: unable to access: Received HTTP code 407 from proxy after CONNECT"

Advanced notes

Frequently asked questions

Related errors

Official resources & further reading