diff --git a/libavformat/http.c b/libavformat/http.c
index eea8dedcbc..a768b19fd9 100644
--- a/libavformat/http.c
+++ b/libavformat/http.c
@@ -93,7 +93,7 @@ static int http_open_cnx(URLContext *h)
     char auth[1024], proxyauth[1024] = "";
     char path1[1024];
     char buf[1024], urlbuf[1024];
-    int port, use_proxy, err, location_changed = 0, redirects = 0;
+    int port, use_proxy, err, location_changed = 0, redirects = 0, attempts = 0;
     HTTPAuthType cur_auth_type, cur_proxy_auth_type;
     HTTPContext *s = h->priv_data;
     URLContext *hd = NULL;
@@ -145,16 +145,18 @@ static int http_open_cnx(URLContext *h)
     cur_proxy_auth_type = s->auth_state.auth_type;
     if (http_connect(h, path, local_path, hoststr, auth, proxyauth, &location_changed) < 0)
         goto fail;
+    attempts++;
     if (s->http_code == 401) {
-        if (cur_auth_type == HTTP_AUTH_NONE && s->auth_state.auth_type != HTTP_AUTH_NONE) {
+        if ((cur_auth_type == HTTP_AUTH_NONE || s->auth_state.stale) &&
+            s->auth_state.auth_type != HTTP_AUTH_NONE && attempts < 4) {
             ffurl_close(hd);
             goto redo;
         } else
             goto fail;
     }
     if (s->http_code == 407) {
-        if (cur_proxy_auth_type == HTTP_AUTH_NONE &&
-            s->proxy_auth_state.auth_type != HTTP_AUTH_NONE) {
+        if ((cur_proxy_auth_type == HTTP_AUTH_NONE || s->proxy_auth_state.stale) &&
+            s->proxy_auth_state.auth_type != HTTP_AUTH_NONE && attempts < 4) {
             ffurl_close(hd);
             goto redo;
         } else
@@ -166,6 +168,7 @@ static int http_open_cnx(URLContext *h)
         ffurl_close(hd);
         if (redirects++ >= MAX_REDIRECTS)
             return AVERROR(EIO);
+        attempts = 0;
         location_changed = 0;
         goto redo;
     }
@@ -598,7 +601,7 @@ static int http_proxy_open(URLContext *h, const char *uri, int flags)
     char hostname[1024], hoststr[1024];
     char auth[1024], pathbuf[1024], *path;
     char line[1024], lower_url[100];
-    int port, ret = 0;
+    int port, ret = 0, attempts = 0;
     HTTPAuthType cur_auth_type;
     char *authstr;
 
@@ -665,8 +668,10 @@ redo:
             break;
         s->line_count++;
     }
-    if (s->http_code == 407 && cur_auth_type == HTTP_AUTH_NONE &&
-        s->proxy_auth_state.auth_type != HTTP_AUTH_NONE) {
+    attempts++;
+    if (s->http_code == 407 &&
+        (cur_auth_type == HTTP_AUTH_NONE || s->proxy_auth_state.stale) &&
+        s->proxy_auth_state.auth_type != HTTP_AUTH_NONE && attempts < 2) {
         ffurl_close(s->hd);
         s->hd = NULL;
         goto redo;