diff --git a/src/cdp/domains/fetch.zig b/src/cdp/domains/fetch.zig
index 5397cc45..ca4258bd 100644
--- a/src/cdp/domains/fetch.zig
+++ b/src/cdp/domains/fetch.zig
@@ -313,7 +313,6 @@ fn continueWithAuth(cmd: anytype) !void {
     errdefer transfer.abortAuthChallenge();
 
     // restart the request with the provided credentials.
-    // we need to duplicate the cre
     const arena = transfer.arena.allocator();
     transfer.updateCredentials(
         try std.fmt.allocPrintZ(arena, "{s}:{s}", .{
@@ -322,6 +321,7 @@ fn continueWithAuth(cmd: anytype) !void {
         }),
     );
 
+    transfer.reset();
     try bc.cdp.browser.http_client.process(transfer);
 
     if (intercept_state.empty()) {
diff --git a/src/http/Client.zig b/src/http/Client.zig
index d5b274e7..62d58a5f 100644
--- a/src/http/Client.zig
+++ b/src/http/Client.zig
@@ -371,7 +371,7 @@ fn perform(self: *Client, timeout_ms: c_int) !void {
         const transfer = try Transfer.fromEasy(easy);
 
         // In case of auth challenge
-        if (transfer._auth_challenge != null) {
+        if (transfer._auth_challenge != null and transfer._tries < 10) { // TODO give a way to configure the number of auth retries.
             if (transfer.client.notification) |notification| {
                 var wait_for_interception = false;
                 notification.dispatch(.http_request_auth_required, &.{ .transfer = transfer, .wait_for_interception = &wait_for_interception });
@@ -643,6 +643,21 @@ pub const Transfer = struct {
     _redirecting: bool = false,
     _auth_challenge: ?AuthChallenge = null,
 
+    // number of times the transfer has been tried.
+    // incremented by reset func.
+    _tries: u8 = 0,
+
+    pub fn reset(self: *Transfer) void {
+        self._redirecting = false;
+        self._auth_challenge = null;
+        self._notified_fail = false;
+        self._header_done_called = false;
+        self.response_header = null;
+        self.bytes_received = 0;
+
+        self._tries += 1;
+    }
+
     fn deinit(self: *Transfer) void {
         self.req.headers.deinit();
         if (self._handle) |handle| {