11

In the OAuth 1.0 spec it is suggested to respond with the following WWW-Authenticate header:

WWW-Authenticate: OAuth realm="http://server.example.com/"

Is it suitable to add any other informative data to this header? In case a request for a protected resource fails, would it be reasonable to include some information as to why? Such as:

WWW-Authenticate: OAuth realm="http://server.example.com/", access token invalid

Or is this contrary to the purpose of the response header?

Community
  • 1
  • 1
Jon Nylander
  • 8,743
  • 5
  • 34
  • 45

3 Answers3

32

Note for anyone just stumbling across this: The OAuth 2.0 bearer token spec adds "error", "error_description", and "error_uri" attributes to the "WWW-Authenticate" header for reporting additional error information, and it specifies when they should and shouldn't be used.

E.g.:

 HTTP/1.1 401 Unauthorized
 WWW-Authenticate: Bearer realm="example",
                   error="invalid_token",
                   error_description="The access token expired"
Community
  • 1
  • 1
jcl
  • 681
  • 6
  • 5
9

Sounds a little dubious to me. The WWW-Authenticate header is specified by an RFC, which would seem to forbid the example you've given. The OAuth spec says that you can include other WWW-Authenticate fields as defined by the RFC, not that you can just tack arbitrary strings onto the end of it. I would avoid it, unless there is a defined field that you could twist to your purposes.

Community
  • 1
  • 1
Gian
  • 13,735
  • 44
  • 51
  • Your's and Tom's answers were roughly similar, I'll check your answer though since it included the link to the RFC in question. – Jon Nylander Dec 07 '11 at 08:19
  • 1
    Thanks. I'll upvote Tom's answer for great justice, in that case, given that we answered somewhere within the same minute. – Gian Dec 07 '11 at 11:44
8

It's against the spec to do that, and if it wasn't it would probably be something like :

realm="http://server.example.com", oauth_error="access token invalid"

I'd recommend using the response body for things like this, or maybe a X-OAuth-Error header.

Tom van der Woerdt
  • 29,532
  • 7
  • 72
  • 105
  • 1
    Thank you, you're right of course. I already now use the response body for these types of messages. However, some libraries seem to expect a little more information from the header. They may be poorly implemented though. – Jon Nylander Dec 07 '11 at 08:20