AuthenticationHeader

AuthenticationHeader refers to the HTTP header fields used to convey authentication information between a client and a server. In HTTP, authentication is negotiated with two related header fields: the Authorization header, sent by the client, and the WWW-Authenticate header, sent by the server as a challenge. In some programming environments, an object or type named AuthenticationHeader (or AuthenticationHeaderValue) represents the value of the Authorization header, encapsulating a scheme and a parameter.

Structure: An authentication header value consists of a credential scheme followed by a space and a parameter string. Example: Authorization: Bearer mF9.B5f-4; or Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==. The server may respond with a 401 Unauthorized and a WWW-Authenticate header such as WWW-Authenticate: Basic realm="Access to the staging site".

Common schemes include Basic, Bearer (used with OAuth 2.0 and JWTs), Digest, and Negotiate/SPNEGO; many systems support additional schemes. The header can appear in requests or responses depending on the role of the endpoint and the chosen authentication method.

In programming, AuthenticationHeaderValue typically exposes properties such as Scheme and Parameter and provides parsing utilities to construct or decompose header values for HTTP requests and responses.

Security considerations: sensitive credentials or tokens are transmitted in this header and must be protected by transport security (TLS). Do not log the parameter values; rotate credentials and tokens regularly; validate schemes and parameter formats carefully.

See also: HTTP authentication, Authorization header, WWW-Authenticate, OAuth 2.0, JWT, SPNEGO.