Re: NTLM question

Robert Collins wrote:

> Because proxy servers are considered trusted, and there is a (untrue)
> expectation that the proxy returning a 407 is the first proxy in the
> request chain.

It is more than an expectation, it is a HTTP/1.1 SHOULD.

Proxy-Authenticate and Proxy-Authorization is a hop-by-hop headers. As such they
are not supposed to be forwarded by proxies.

It is the "child" proxy responsibility to log in to the "parent", not the end
users/browsers. How this is done is up to the implementation of the
"child" proxy.

Note: In context of HTTP/RFC-2616, a child proxy is a client while talking to a
parent proxy.

--
Henrik