WWWAuthenticate

The WWW-Authenticate HTTP response header is used by a server to indicate that the requested resource requires authentication and to specify the authentication scheme(s) that should be used. It is sent with a 401 Unauthorized response (and, for some proxies, with a 407 Proxy Authentication Required) and is defined in HTTP/1.1 specifications. The header provides the challenges that the client must satisfy before access is granted.

Syntax: The header carries one or more challenges, each consisting of a scheme name and parameters. A typical value for Basic authentication might be: WWW-Authenticate: Basic realm="Example". For Digest authentication: WWW-Authenticate: Digest realm="Example", qop="auth", nonce="...", opaque="...". A client that receives these challenges will select a scheme and include an Authorization header in subsequent requests (for example, Authorization: Basic … or Authorization: Digest …).

Common schemes include Basic, Digest, and Bearer (used with OAuth 2.0). Bearer may include error fields such as error and error_description as part of the challenge. Proxies use the Proxy-Authenticate header to convey similar challenges.

History and standards: The Basic and Digest schemes were specified in RFC 2617 and later updated by RFC 7235. Bearer tokens were defined by RFC 6750. The header is a response header; clients must not send credentials until challenged, and credentials are transmitted over a secure channel to protect them from interception.

Security considerations: Use TLS to protect credentials in transit, and avoid exposing sensitive information in logs or error messages. The realm value provides a description of the protected area and is not a security boundary by itself. The presence of multiple challenges allows servers to offer fallback schemes for compatibility.