WwwAuthenticateBuilder Class
Builds WWW-Authenticate challenge values for the Bearer scheme (RFC 6750 §3)
and the DPoP scheme (RFC 9449 §7.1). Endpoint-agnostic and framework-agnostic so the
same emission logic serves UserInfo, introspection, revocation, and any future
protected endpoint, regardless of whether the host is ASP.NET Core MVC, minimal APIs,
or another framework altogether.
public static class WwwAuthenticateBuilderInheritance System.Object → WwwAuthenticateBuilder
Remarks
The Bearer challenge attaches error / error_description when the inbound
failure is in fact a Bearer-token failure (invalid_token, insufficient_scope).
When the failure is a DPoP-specific error and Bearer is advertised alongside DPoP, the
Bearer line carries only the realm — RFC 9449 §7.1 example: «the Bearer scheme didn't
fail; the client used the DPoP scheme», so attaching error="invalid_dpop_proof"
to the Bearer line would be misleading.
Methods
WwwAuthenticateBuilder.BuildBasicChallenge(string) Method
Builds a WWW-Authenticate: Basic challenge per RFC 7617 §2 for client-authentication
failures (RFC 6749 §5.2). Only the realm parameter is emitted: unlike Bearer (RFC 6750 §3),
the Basic scheme defines no error attributes, so the error itself stays in the JSON body.
public static string BuildBasicChallenge(string? realm);Parameters
realm System.String
Returns
WwwAuthenticateBuilder.BuildBearerChallenge(OidcError, string, bool) Method
Builds a WWW-Authenticate: Bearer challenge per RFC 6750 §3. The error
and error_description attributes are emitted only when the inbound failure is
a Bearer-scheme failure; pass includeError as false for
dual-scheme responses where the Bearer line is informational.
public static string BuildBearerChallenge(Abblix.Oidc.Server.Common.OidcError error, string? realm, bool includeError=true);Parameters
error OidcError
realm System.String
includeError System.Boolean
Returns
WwwAuthenticateBuilder.BuildChallenges(OidcError, string, IEnumerable<string>, bool) Method
Builds the full set of WWW-Authenticate challenge lines for an error
response. Returns DPoP first, Bearer second (matching the RFC 9449 §7.1 example
ordering) when both schemes are advertised.
public static System.Collections.Generic.IReadOnlyList<string> BuildChallenges(Abblix.Oidc.Server.Common.OidcError error, string? realm, System.Collections.Generic.IEnumerable<string> dpopAlgs, bool advertiseBearer);Parameters
error OidcError
realm System.String
dpopAlgs System.Collections.Generic.IEnumerable<System.String>
advertiseBearer System.Boolean
Returns
System.Collections.Generic.IReadOnlyList<System.String>
WwwAuthenticateBuilder.BuildDPoPChallenge(OidcError, string, IEnumerable<string>) Method
Builds a WWW-Authenticate: DPoP challenge per RFC 9449 §7.1, advertising the
JWS algorithms the AS accepts on a proof.
public static string BuildDPoPChallenge(Abblix.Oidc.Server.Common.OidcError error, string? realm, System.Collections.Generic.IEnumerable<string> algs);