Visual RFC.
ALL RFCs / RFC 6585
Read the RFC ↗
RFC 6585 / ADDITIONAL HTTP STATUS CODES

511: Recognize a network portal

04

An intercepting network proxy asks the client to obtain network access; the response is not a login request from the intended website.

DIAGRAMRead RFC section 6 ↗
RFC 6585 · § 6EXAMPLE
3 / 3
511: Recognize a network portalA plain HTTP request is intercepted by a network proxy before the origin. The proxy returns 511 with a separate HTTPS portal link; navigating there does not prove trust or grant access.511: the network is askingPlain HTTP example; never bypass TLS validationBrowserNetwork proxyOriginHTTP GET for originnot reached511 + portal linkNot an origin loginSeparate portalHTTPS: login.example.netNo access grant shownOpening the portal is not proof of its trustworthiness
03
Navigate to the portal separately.

The browser may open the separately identified portal. This is not an origin login and does not itself establish trust or grant access.

Source for this drawing: RFC 6585 · Read RFC section 6 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

RFC 9110 HTTP RFC 9111 Caching

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Terms in this drawing
Captive portal
A network access page encountered before ordinary network use is permitted.
Origin server
The server responsible for the resource the client requested.
Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

Network access and website authentication are separate trust boundaries.

  • 511 Network Authentication Required means the client needs to authenticate to gain network access. It is intended for intercepting proxies and SHOULD NOT be generated by origin servers.
  • The response SHOULD link to a resource for submitting credentials. It SHOULD NOT contain a challenge or the login interface itself, to avoid associating network login with the originally requested website.
  • 511 responses MUST NOT be stored by a cache. The diagram illustrates plain HTTP interception and a separate HTTPS portal link. Intercepting an HTTPS origin request can cause certificate errors; 511 does not authorize bypassing TLS certificate validation.
DETAILS

A 511 response does not prove that the portal is trustworthy, and the requested origin has not returned its content. The final scene shows only navigation to the separate portal; it does not claim credentials were submitted or network access was granted. RFC 6585 limits damage from captive portals rather than recommending their deployment.

Read the RFC section ↗

All chapters in RFC 6585

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗