WWW-Authenticate

The HTTP WWW-Authenticate response header defines the authentication method that should be used to gain access to a resource.

The WWW-Authenticate header is sent along with a 401 Unauthorized response.

Syntax

WWW-Authenticate: <type> realm=<realm>

Directives

<type>

Authentication type. A common type is "Basic". IANA maintains a list of Authentication schemes.

realm=<realm>

A description of the protected area. If no realm is specified, clients often display a formatted hostname instead.

charset=<charset>

Tells the client the server's prefered encoding scheme when submiting a username and password. The only allowed value is the case insensitive string "UTF-8". This does not relate to the encoding of the realm string.

Examples

Typically, a server response contains a WWW-Authenticate header that looks like these:

WWW-Authenticate: Basic

WWW-Authenticate: Basic realm="Access to the staging site", charset="UTF-8"

See also HTTP authentication for examples on how to configure Apache or nginx servers to password protect your site your HTTP basic authentication.

Specifications

Browser compatibility

See also

• HTTP authentication
• Authorization
• Proxy-Authorization
• Proxy-Authenticate
• 401, 403, 407