WWW-Authenticate

O cabeçalho da resposta HTTP WWW-Authenticate define o método de autenticação a ser usado para obter acesso ao recurso.

O cabeçalho WWW-Authenticate é enviado junto a resposta 401 Unauthorized.

Header type Response header
Forbidden header name no

Sintaxe

WWW-Authenticate: <type> realm=<realm>

Diretivas

<type>
Authentication type. Um tipo comum de autenticação é "Basic". IANA mantém uma list of Authentication schemes.
realm=<realm>
Uma descrição da área protegida. Se nenhuma área for informada, os clientes frequentemente exibirão um hostname formatado.
charset=<charset>
Informa ao cliente qual é o encoding do servidor quando for submetido usuário e senha. O único valor permitido é "UTF-8". Isso não está relacionado ao encoding da realm string.

Exemplos

Typically, a server response contains a WWW-Authenticate header that looks like these:

WWW-Authenticate: Basic

WWW-Authenticate: Basic realm="Access to the staging site", charset="UTF-8"

See also HTTP authentication for examples on how to configure Apache or nginx servers to password protect your site your HTTP basic authentication.

Especificações

Specification Title
RFC 7235, sessão 4.1: WWW-Authenticate HTTP/1.1: Authentication
RFC 7617 The 'Basic' HTTP Authentication Scheme

Compatibilidade de Navegadores

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
WWW-AuthenticateChrome Full support 1Edge ? Firefox Full support 1IE ? Opera Full support YesSafari ? WebView Android Full support 37Chrome Android Full support YesFirefox Android Full support YesOpera Android Full support YesSafari iOS ? Samsung Internet Android Full support Yes

Legend

Full support  
Full support
Compatibility unknown  
Compatibility unknown

Veja também

Última modificação:

, by MDN contributors
Tópicos relacionados
  1. HTTP
  2. Guides:
  3. Resources and URIs
    1. Identifying resources on the Web
    2. Data URIs
    3. Introduction to MIME Types
    4. Complete list of MIME Types
    5. Choosing between www and non-www URLs
  4. HTTP guide
    1. Basics of HTTP
    2. Overview of HTTP
    3. Evolution of HTTP
    4. HTTP Messages
    5. A typical HTTP session
    6. Connection management in HTTP/1.x
    7. Protocol upgrade mechanism
  5. HTTP security
    1. Content Security Policy (CSP)
    2. HTTP Public Key Pinning (HPKP)
    3. HTTP Strict Transport Security (HSTS)
    4. Cookie security
    5. X-Content-Type-Options
    6. X-Frame-Options
    7. X-XSS-Protection
    8. Mozilla web security guidelines
    9. Mozilla Observatory
  6. HTTP access control (CORS)
  7. HTTP authentication
  8. HTTP caching
  9. HTTP compression
  10. HTTP conditional requests
  11. HTTP content negotiation
  12. HTTP cookies
  13. HTTP range requests
  14. HTTP redirects
  15. HTTP specifications
  16. Feature policy
  17. References:
  18. HTTP headers
    1. Accept [Traduzir]
    2. Accept-Charset [Traduzir]
    3. Accept-Encoding [Traduzir]
    4. Accept-Language
    5. Accept-Patch [Traduzir]
    6. Accept-Ranges [Traduzir]
    7. Access-Control-Allow-Credentials [Traduzir]
    8. Access-Control-Allow-Headers [Traduzir]
    9. Access-Control-Allow-Methods [Traduzir]
    10. Access-Control-Allow-Origin
    11. Access-Control-Expose-Headers [Traduzir]
    12. Access-Control-Max-Age [Traduzir]
    13. Access-Control-Request-Headers
    14. Access-Control-Request-Method [Traduzir]
    15. Age
    16. Allow [Traduzir]
    17. Alt-Svc [Traduzir]
    18. Authorization [Traduzir]
    19. Cache-Control
    20. Clear-Site-Data [Traduzir]
    21. Conexão
    22. Content-Disposition [Traduzir]
    23. Content-Encoding [Traduzir]
    24. Content-Language
    25. Content-Length
    26. Content-Location [Traduzir]
    27. Content-Range [Traduzir]
    28. Content-Security-Policy [Traduzir]
    29. Content-Security-Policy-Report-Only [Traduzir]
    30. Content-Type
    31. Cookie [Traduzir]
    32. Cookie2 [Traduzir]
    33. Cross-Origin-Resource-Policy [Traduzir]
    34. DNT [Traduzir]
    35. Date [Traduzir]
    36. Digest [Traduzir]
    37. ETag [Traduzir]
    38. Early-Data [Traduzir]
    39. Expect [Traduzir]
    40. Expect-CT [Traduzir]
    41. Expires
    42. Feature-Policy [Traduzir]
    43. Forwarded [Traduzir]
    44. From [Traduzir]
    45. Host
    46. If-Match [Traduzir]
    47. If-Modified-Since
    48. If-None-Match [Traduzir]
    49. If-Range [Traduzir]
    50. If-Unmodified-Since
    51. Index [Traduzir]
    52. Keep-Alive
    53. Large-Allocation [Traduzir]
    54. Last-Modified
    55. Link [Traduzir]
    56. Location [Traduzir]
    57. Origin [Traduzir]
    58. Pragma [Traduzir]
    59. Proxy-Authenticate [Traduzir]
    60. Proxy-Authorization [Traduzir]
    61. Public-Key-Pins [Traduzir]
    62. Public-Key-Pins-Report-Only [Traduzir]
    63. Range [Traduzir]
    64. Referer [Traduzir]
    65. Referrer-Policy [Traduzir]
    66. Retry-After
    67. Save-Data [Traduzir]
    68. Sec-WebSocket-Accept [Traduzir]
    69. Server
    70. Server-Timing [Traduzir]
    71. Set-Cookie
    72. Set-Cookie2 [Traduzir]
    73. SourceMap
    74. Strict-Transport-Security
    75. TE [Traduzir]
    76. Timing-Allow-Origin [Traduzir]
    77. Tk [Traduzir]
    78. Trailer [Traduzir]
    79. Transfer-Encoding [Traduzir]
    80. Upgrade-Insecure-Requests
    81. User-Agent
    82. Vary [Traduzir]
    83. Via [Traduzir]
    84. WWW-Authenticate
    85. Want-Digest [Traduzir]
    86. Warning [Traduzir]
    87. X-Content-Type-Options
    88. X-DNS-Prefetch-Control
    89. X-Forwarded-For [Traduzir]
    90. X-Forwarded-Host [Traduzir]
    91. X-Forwarded-Proto [Traduzir]
    92. X-Frame-Options [Traduzir]
    93. X-XSS-Protection [Traduzir]
  19. HTTP request methods
    1. CONNECT
    2. DELETE
    3. GET
    4. HEAD
    5. OPTIONS
    6. PATCH
    7. POST
    8. PUT
    9. TRACE
  20. HTTP response status codes
    1. 100 Continue
    2. 101 Switching Protocols
    3. 103 Early Hints [Traduzir]
    4. 200 OK
    5. 201 Created
    6. 202 Accepted
    7. 203 Non-Authoritative Information
    8. 204 No Content
    9. 205 Reset Content
    10. 206 Partial Content [Traduzir]
    11. 300 Multiple Choices [Traduzir]
    12. 301 Moved Permanently [Traduzir]
    13. 302 Found
    14. 303 See Other
    15. 304 Not Modified
    16. 307 Redirecionamento temporário
    17. 308 Permanent Redirect [Traduzir]
    18. 400 Bad Request
    19. 401 Unauthorized
    20. 402 Payment Required [Traduzir]
    21. 403 Forbidden
    22. 404 Not Found
    23. 405 Method Not Allowed
    24. 406 Not Acceptable [Traduzir]
    25. 407 Proxy Authentication Required
    26. 408 Request Timeout
    27. 409 Conflict
    28. 410 Gone
    29. 411 Length Required
    30. 412 Precondition Failed [Traduzir]
    31. 413 Payload Too Large
    32. 414 URI Too Long
    33. 415 Unsupported Media Type
    34. 416 Range Not Satisfiable [Traduzir]
    35. 417 Expectation Failed
    36. 418 I'm a teapot
    37. 422 Unprocessable Entity
    38. 425 Too Early
    39. 426 Upgrade Required
    40. 428 Precondition Required
    41. 429 Too Many Requests
    42. 431 Request Header Fields Too Large [Traduzir]
    43. 451 Unavailable For Legal Reasons
    44. 500 Internal Server Error
    45. 501 Not Implemented
    46. 502 Bad Gateway
    47. 503 Service Unavailable
    48. 504 Gateway Timeout
    49. 505 HTTP Version Not Supported
    50. 511 Network Authentication Required [Traduzir]
  21. CSP directives
    1. CSP: base-uri [Traduzir]
    2. CSP: block-all-mixed-content [Traduzir]
    3. CSP: child-src [Traduzir]
    4. CSP: connect-src [Traduzir]
    5. CSP: default-src [Traduzir]
    6. CSP: font-src [Traduzir]
    7. CSP: form-action [Traduzir]
    8. CSP: frame-ancestors [Traduzir]
    9. CSP: frame-src [Traduzir]
    10. CSP: img-src [Traduzir]
    11. CSP: manifest-src [Traduzir]
    12. CSP: media-src [Traduzir]
    13. CSP: navigate-to [Traduzir]
    14. CSP: object-src [Traduzir]
    15. CSP: plugin-types [Traduzir]
    16. CSP: prefetch-src [Traduzir]
    17. CSP: referrer [Traduzir]
    18. CSP: report-to [Traduzir]
    19. CSP: report-uri [Traduzir]
    20. CSP: require-sri-for [Traduzir]
    21. CSP: sandbox [Traduzir]
    22. CSP: script-src [Traduzir]
    23. CSP: script-src-attr [Traduzir]
    24. CSP: script-src-elem [Traduzir]
    25. CSP: style-src [Traduzir]
    26. CSP: style-src-attr [Traduzir]
    27. CSP: style-src-elem [Traduzir]
    28. CSP: trusted-types [Traduzir]
    29. CSP: upgrade-insecure-requests [Traduzir]
    30. CSP: worker-src [Traduzir]
  22. CORS errors
    1. Reason: CORS disabled [Traduzir]
    2. Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz' [Traduzir]
    3. Reason: CORS header 'Access-Control-Allow-Origin' missing
    4. Reason: CORS header ‘Origin’ cannot be added [Traduzir]
    5. Reason: CORS preflight channel did not succeed [Traduzir]
    6. Razão: A requisição CORS não foi bem sucedida
    7. Reason: CORS request external redirect not allowed [Traduzir]
    8. Reason: CORS request not HTTP
    9. Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’ [Traduzir]
    10. Reason: Did not find method in CORS header ‘Access-Control-Allow-Methods’ [Traduzir]
    11. Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed [Traduzir]
    12. Reason: expected ‘true’ in CORS header ‘Access-Control-Allow-Credentials’ [Traduzir]
    13. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ [Traduzir]
    14. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Methods’ [Traduzir]
    15. Reason: missing token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel [Traduzir]
  23. Feature-Policy directives
    1. Feature-Policy: accelerometer [Traduzir]
    2. Feature-Policy: ambient-light-sensor [Traduzir]
    3. Feature-Policy: autoplay [Traduzir]
    4. Feature-Policy: camera [Traduzir]
    5. Feature-Policy: display-capture [Traduzir]
    6. Feature-Policy: document-domain [Traduzir]
    7. Feature-Policy: encrypted-media [Traduzir]
    8. Feature-Policy: fullscreen [Traduzir]
    9. Feature-Policy: geolocation [Traduzir]
    10. Feature-Policy: gyroscope [Traduzir]
    11. Feature-Policy: layout-animations [Traduzir]
    12. Feature-Policy: legacy-image-formats [Traduzir]
    13. Feature-Policy: magnetometer [Traduzir]
    14. Feature-Policy: microphone [Traduzir]
    15. Feature-Policy: midi [Traduzir]
    16. Feature-Policy: oversized-images [Traduzir]
    17. Feature-Policy: payment [Traduzir]
    18. Feature-Policy: picture-in-picture [Traduzir]
    19. Feature-Policy: speaker [Traduzir]
    20. Feature-Policy: sync-xhr [Traduzir]
    21. Feature-Policy: unoptimized-images [Traduzir]
    22. Feature-Policy: unsized-media [Traduzir]
    23. Feature-Policy: usb [Traduzir]
    24. Feature-Policy: vibrate [Traduzir]
    25. Feature-Policy: vr [Traduzir]
    26. Feature-Policy: wake-lock [Traduzir]
    27. Feature-Policy: webauthn [Traduzir]
    28. Feature-Policy: xr [Traduzir]