No WWW-Authenticate header on WebDAV when 2FA is set up

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

First reported on GNOME/gvfs#617.

When accessing the remote.php/dav or remote.php/webdav endpoints with a correct, 2FA-enabled username and an incorrect/empty password (like GVFS does), the particular error does not return a WWW-Authenticate header, which violates standard and prevents GVFS from connecting.

This only occurs with the password login forbidden error.

Steps to reproduce

1. Given user 2fauser with 2-factor authentication enabled
2. curl -i https://2fauser:@NC/remote.php/dav
3. No www-authenticate header.

Expected behavior

The error returns a www-authenticate header, like other 401 errors.

Installation method

NixOS option services.nextcloud

Operating system

NixOS 21.11

PHP engine version

PHP 8.0.18

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated to a major version (ex. 22.2.3 to 23.0.1)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

Enabled:
  - accessibility: 1.9.0
  - activity: 2.15.0
  - admin_audit: 1.13.0
  - announcementcenter: 6.1.1
  - apporder: 0.15.0
  - breezedark: 23.2.1
  - bruteforcesettings: 2.4.0
  - calendar: 3.2.2
  - camerarawpreviews: 0.7.15
  - circles: 23.1.0
  - cloud_federation_api: 1.6.0
  - cms_pico: 1.0.18
  - collectives: 1.0.0
  - comments: 1.13.0
  - contacts: 4.1.0
  - contactsinteraction: 1.4.0
  - dashboard: 7.3.0
  - data_request: 1.10.0
  - dav: 1.21.0
  - deck: 1.6.1
  - dicomviewer: 1.2.3
  - drawio: 1.0.2
  - external: 3.10.2
  - extract: 1.3.3
  - federatedfilesharing: 1.13.0
  - federation: 1.13.0
  - files: 1.18.0
  - files_3d: 0.5.0
  - files_accesscontrol: 1.13.0
  - files_automatedtagging: 1.13.0
  - files_external: 1.15.0
  - files_fulltextsearch: 23.0.1
  - files_linkeditor: 1.1.9
  - files_rightclick: 1.2.0
  - files_sharing: 1.15.0
  - files_trashbin: 1.13.0
  - files_versions: 1.16.0
  - files_videoplayer: 1.12.0
  - firstrunwizard: 2.12.0
  - flow_notifications: 1.2.0
  - forms: 2.5.0
  - fulltextsearch: 23.0.0
  - fulltextsearch_elasticsearch: 23.0.0
  - gpxmotion: 0.1.0
  - groupfolders: 11.1.2
  - guests: 2.2.0
  - impersonate: 1.10.0
  - integration_dropbox: 1.0.4
  - integration_google: 1.0.6
  - integration_onedrive: 1.1.2
  - jsloader: 1.5.0
  - keeporsweep: 0.2.1
  - keeweb: 0.6.8
  - logreader: 2.8.0
  - lookup_server_connector: 1.11.0
  - mail: 1.11.7
  - maps: 0.1.10
  - mediadc: 0.1.9
  - metadata: 0.15.0
  - music: 1.5.1
  - nextcloud_announcements: 1.12.0
  - notes: 4.3.1
  - notifications: 2.11.1
  - oauth2: 1.11.0
  - oidc: 0.1.0
  - onlyoffice: 7.3.2
  - password_policy: 1.13.0
  - photos: 1.5.0
  - previewgenerator: 4.0.0
  - privacy: 1.7.0
  - provisioning_api: 1.13.0
  - quota_warning: 1.14.0
  - ransomware_protection: 1.13.0
  - recognize: 1.11.0
  - recommendations: 1.2.0
  - serverinfo: 1.13.0
  - settings: 1.5.0
  - side_menu: 2.3.5
  - socialsharing_email: 2.5.0
  - socialsharing_facebook: 2.5.0
  - socialsharing_twitter: 2.5.0
  - solid: 0.0.3
  - spreed: 13.0.5
  - survey_client: 1.11.0
  - systemtags: 1.13.0
  - tasks: 0.14.4
  - text: 3.4.1
  - theming: 1.14.0
  - theming_customcss: 1.11.0
  - twofactor_backupcodes: 1.12.0
  - twofactor_email: 2.3.0
  - twofactor_nextcloud_notification: 3.3.1
  - twofactor_totp: 6.2.0
  - twofactor_u2f: 6.3.0
  - twofactor_webauthn: 0.3.1
  - unsplash: 1.2.4
  - updatenotification: 1.13.0
  - user_status: 1.3.1
  - viewer: 1.7.0
  - weather_status: 1.3.0
  - welcome: 1.0.1
  - workflow_pdf_converter: 1.8.0
  - workflow_script: 1.8.0
  - workflowengine: 2.5.0
Disabled:
  - encryption: 2.5.0
  - files_pdfviewer: 2.1.0
  - hidesidebars: 2.0.0
  - integration_whiteboard: 0.0.14
  - openhab: 0.9.5
  - quickaccesssorting: 1.1.3
  - richdocuments: 5.0.3
  - richdocumentscode: 21.11.306
  - sharebymail: 1.12.0
  - souvenirs: 1.3.0
  - support: 1.0.0
  - telephoneprovider: 1.0.3
  - user_ldap: 1.5.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

No response

Additional info

No response

Start with the remote.php/dav and remote.php/webdav entry points and reproduce the request with curl using a correct 2FA-enabled username and an empty or incorrect password. Done means the password-login-forbidden 401 response includes a WWW-Authenticate header, matching other 401 responses.