CODEWITHSUNDEEP
httpauthenticationopenidhttp-headers
James A. Rosen
James A. Rosen

Reputation: 65232

What should I pass for the WWW-Authenticate header on 401s if I'm only using OpenID?

The HTTP spec states:

10.4.2 401 Unauthorized

The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource.

If the only login scheme I support is OpenID (or CAS, or OAuth tokens, &c.), what should I put in this field? That is, how do I indicate that the client needs to pre-authenticate and create a session rather than try to send credentials along with each request?

Before you answer, "don't send a 401; send a 3xx redirecting to the OpenID login page," what about for non-HTML clients? How, for example, would Stack Overflow do an API that my custom software could interact with?

Upvotes: 35

Views: 30596

Answers (2)

Andrew Arnott
Andrew Arnott

Reputation: 81771

There is an OAuth Discovery spec that would indicate what to put into the WWW-Authenticate header -- if the spec were not obsolete without a replacement spec yet.

Upvotes: 3

Chris Boyle
Chris Boyle

Reputation: 11551

According to RFC2617 the auth-scheme can be anything; if you really want a 401 you're not technically breaking spec by making something up like WWW-Authenticate: OpenID realm="My Realm" location="http://my/login/location". Having said that, behaviour of other people's code when you do that is of course undefined. :-)

Upvotes: 27

Related Questions