buddy.auth.backends.token/handle-unauthorized-default violates RFC 7235 section 4.1. WWW-Authenticate
Open
- Dominant language
- Clojure
- Stars
- 304
- Forks
- 69
- PR merge metrics
- No merged PRs in 30d
Description
[RFC 7235 section 4.1. WWW-Authenticate](https://tools.ietf.org/html/rfc7235#section-4.1) specifies:
> A server generating a 401 (Unauthorized) response MUST send a WWW-Authenticate header field containing at least one challenge.
However, buddy.auth.backends.token/handle-unauthorized-default sends a 401 status response without a `WWW-Authenticate` header:
https://github.com/funcool/buddy-auth/blob/36a02a43d781ed10ca1fec1984f444f5dc818215/src/buddy/auth/backends/token.clj#L22-L27
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.