WWW-Authenticate

The HTTP WWW-Authenticate response header defines the authentication method that should be used to gain access to a resource.

The WWW-Authenticate header is sent along with a 401 Unauthorized response.

Syntax

WWW-Authenticate: <type> realm=<realm>

Directives

<type>

Authentication type. A common type is "Basic". IANA maintains a list of Authentication schemes.

realm=<realm>

A description of the protected area. If no realm is specified, clients often display a formatted hostname instead.

charset=<charset>

Tells the client the server's prefered encoding scheme when submiting a username and password. The only allowed value is the case insensitive string "UTF-8". This does not relate to the encoding of the realm string.

Examples

Typically, a server response contains a WWW-Authenticate header that looks like these:

WWW-Authenticate: Basic

WWW-Authenticate: Basic realm="Access to the staging site", charset="UTF-8"

See also HTTP authentication for examples on how to configure Apache or nginx servers to password protect your site your HTTP basic authentication.

Specifications

Browser compatibilityUpdate compatibility data on GitHub

See also

• HTTP authentication
• Authorization
• Proxy-Authorization
• Proxy-Authenticate
• 401, 403, 407