Question

I’ve read through RFC 2617 and can’t find there or anywhere else what the delimiter is if multiple schemes are supported. For example, suppose both Basic and Digest are supported. I understand that it may appear this way:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic
WWW-Authenticate: Digest

But I’ve also read that both can be listed as one line, but no one ever shows an example or describes what delimiter to use. I’ve seen cautions that commas can be used within a single scheme:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Digest param1="foo", param2="bar"

I’ve also read that if commas are used within a scheme, that other schemes must be placed on separate lines. So I imagine in the above case if we added Basic it would appear like this:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Digest param1="foo", param2="bar"
WWW-Authenticate: Basic

That’s simple enough. But now suppose you just have one line

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Scheme stuff, morestuff, more stuff

Which is that? Is that a comma-delimited list of schemes, or is that one scheme, with a few parameters?

Answer 1

As far as I can tell, the spec punts on the issue. Section 1.2 states:

Note: User agents will need to take special care in parsing the WWW-
Authenticate or Proxy-Authenticate header field value if it contains
more than one challenge, or if more than one WWW-Authenticate header
field is provided, since the contents of a challenge may itself
contain a comma-separated list of authentication parameters.

I think we can translate special care to best of luck chap.

Pragmatism
As a practical matter, I suspect multiple schemes means one should use multiple wwww-authenticate headers. Schemes are extensible; e.g., I can come up with a scheme called “strawberry” or “opaque” if I want to be sinister. Given this, there isn’t really a good way to parse a one liner without some sort of ‘scheme termination’ delimiter.

W3C Discussion
You aren’t the first person with this question. There was a discussion on the W3C mailing list. The poster stated :

I wasn’t questioning the need to provide multiple challenges in a
single response. I was only questioning the wisdom in allowing
multiple challenges in a single header field, given the odd
combination of separators it creates.

Some other threads discussing current issues & future action that may be of interest:

• root of above thread
• Backwards definition of authentication header
• #342 WWW-Authenticate ABNF slightly ambiguous
• WWW-Authenticate ABNF is ambiguous
• future http 2 – Multi-legged Authentication for HTTP Multiplexing

If only …
Not that I have the stomach for it, but one could dig through the chromimum, firefox & webkit code to see how those communities have handled the issue.