A student's open lab: learning and sharing, free for everyone.

SIP UniverseFree University

Home / TLS, SRTP, identity, and abuse / 401, 407, and digest

401, 407, and digest

A 401 from a UAS is answered with Authorization. A 407 from a proxy is answered with Proxy-Authorization.

Learn in 5 minutes

  1. Pair 401 with Authorization and WWW-Authenticate
  2. Pair 407 with Proxy-Authorization and Proxy-Authenticate
  3. Stop at the header split and do not compute an attack

Visual

407 first, then a 401 · study drawing · cyphermonkeylabs.com AliceProxyUAS INVITE 407 INVITE 401

SVG HTML PNG

RFC 3261 section 22 is the SIP rule. RFC 7616 is the HTTP digest specification for algorithms.

Worked example

Read a 407 Dissect the 407. Name the challenge header and the header the client must send next.

  1. Press Dissect.
  2. Read the status line.
  3. Find Proxy-Authenticate and note there is no computed response.

Fault

A UAS returned 401 with WWW-Authenticate. The next INVITE adds only Proxy-Authorization, and the UAS challenges again.

RFC 3261 section 22 splits the UAS challenge from the proxy challenge.

Quiz

A 407 is answered with


A 401 is answered with


RFC 7616 is


The digest response in the client header is


Proxy-Authenticate appears on


After a proxy accepts the hop, a UAS may still send


Ecosystem

Glossary, sister systems, and the integration seam for this room.

Workforce management WFM forecasts volume and builds schedules. It consumes contact-center events. It does not parse Via headers. When a forecast is wrong, the SIP symptom is usually queue delay and 480 or carrier congestion, not a broken dialog ID.

Glossary · Ecosystem map · Ports · Troubleshooting

Sources and go deeper