HTTP headers | WWW-Authenticate

05 Jan, 2021
HTTP WWW-Authenticate header is a response-type header. It serves as a support for various authentication mechanisms which are important to control access to pages and other resources as well. All of these mechanisms are based on the use of the 401 status code. The HTTP WWW-Authenticate response header defines the authentication method that ought to be wont to gain access to a resource. As discussed earlier, the WWW-Authenticate header is sent along with a 401 Unauthorized response. 
The working includes a client being responded by a server with a 401 Unauthorized response status which provides information on authorizing with a WWW-Authenticate response header containing a minimum of one challenge. A client that wants to authenticate itself with a server can do so by including an Authorization request-header field with the credentials. Usually, it is done by presenting a password prompt to the user and then issuing the request including the correct Authorization header. 
Diagrammatic representation of basic authentication is as follows: 
Here, is the authentication scheme (“Basic” is the most common scheme and introduced below). The realm is employed to explain the protected area or to point the scope of protection. This could be a message like “Access to the staging site” or similar in order that the user knows to which space they’re trying to urge access to. 
Note: Note: In the case of a “Basic” authentication like shown in the figure, the exchange must happen over an HTTPS (TLS) connection to be secure. 
It is needed to be specified which authentication scheme is used so that the client that wishes to authorize knows how to provide the credentials. 
Syntax: 
WWW-Authenticate: <type> realm=<realm> realm=<realm>
Directives: This header accepts three directives as mentioned above and described below:  
<type>: This directive holds the authentication type. A common type is “Basic”. IANA maintains a list of authentication schemes.
realm=<realm>: This directive describe of the protected area. By default, the formatted hostname is used.
charset=<charset>: Tells the client the server’s preferred encoding scheme when submitting a username and password. The only allowed value is the case the insensitive string “UTF-8”. This doesn’t relate to the encoding of the realm string.
Example:  
WWW-Authenticate: Basic
WWW-Authenticate: Basic realm="Access to the staging site", 
charset="UTF-8"
Supported Browsers: The browsers supported by HTTP headers WWW-Authenticate are listed below:  
Google Chrome
Microsoft Edge
Mozilla Firefox
Internet Explorer
Opera
Safari
 
zack_aayush
HTTP-headers
Picked
Web Technologies
Writing code in comment?
Please use ide.geeksforgeeks.org,
generate link and share the link here.
Difference between var, let and const keywords in JavaScript
How to fetch data from an API in ReactJS ?
Differences between Functional Components and Class Components in React
Remove elements from a JavaScript Array
REST API (Introduction)
Difference Between PUT and PATCH Request
Roadmap to Learn JavaScript For Beginners
How to float three div side by side using CSS?
ReactJS | Router
How to get character array from string in JavaScript?