Malformed WWW-Authenticate header payload returned for UNAUTHORIZED response

[awalls-cx18]

Malformed WWW-Authenticate header payload returned for UNAUTHORIZED response

[awalls-cx18]

FWIW, You could also just insert a space between the Bearer and the , and be RFC compliant, indicating an empty first authentication parameter in the list of authentication parameters, but it wouldn't make much sense and could trip up www-authenticate header parsing implementations that are not careful.

[qiwzhang]

This is not the new behaviors. This is the way since day 1. Unfortunately, ESPv1 is in the maintaining mode to support existing users with existing features. This must be a new usage. We recommend you to switch to ESPv2.

[awalls-cx18]

We've been using ESPv1 for a couple of years. This just came up because we've added some multi-factor authentication that is handled by our backend. We've already adapted our browser resident code to deal with the non-conformance.

Knowing that it is never going to be fixed is fine. Closing.