WwwAuthenticate Class
Builds WWW-Authenticate challenge values: the HTTP grammar, not any one protocol's
vocabulary of errors.
public static class WwwAuthenticateInheritance System.Object → WwwAuthenticate
Remarks
Two packages emit these headers for two different error vocabularies - an authorization server answering with OpenID Connect errors, and a Shared Signals transmitter answering with the three RFC 6750 codes - and they cannot share a type that names either. What they do share is the quoted-string grammar and the rule about when a challenge stays bare, which is what lives here.
Methods
WwwAuthenticate.Challenge(string, string) Method
A challenge advertising scheme and nothing else beyond the realm.
public static string Challenge(string scheme, string? realm=null);Parameters
scheme System.String
realm System.String
Returns
Remarks
This is the form RFC 6750 Section 3.1 requires when the request carried no credentials at all: "If the request lacks any authentication information (e.g., the client was unaware that authentication is necessary or attempted using an unsupported authentication method), the resource server SHOULD NOT include an error code or other error information." A caller that has not tried yet has nothing to correct, and naming an error would describe a failure that did not happen.
WwwAuthenticate.Challenge(string, string, string, string) Method
A challenge naming why the credentials that WERE presented did not suffice.
public static string Challenge(string scheme, string? realm, string error, string? errorDescription);Parameters
scheme System.String
The authentication scheme, such as Bearer.
realm System.String
The protection space, omitted when null or empty.
error System.String
The error code, from whatever vocabulary the scheme defines.
errorDescription System.String
Human-readable detail, omitted when null or empty.