Align Reactive BearerTokenServerAuthenticationEntryPoint with Servlet RFC 9728 WWW-Authenticate behavior

Expected Behavior

The Reactive OAuth2 Resource Server should produce the same default WWW-Authenticate header as the Servlet implementation.

Since Spring Security 7 / Spring Boot 4.1, the Servlet implementation includes RFC 9728 Bearer challenge metadata in the WWW-Authenticate header by default. The Reactive implementation should provide the same behavior for consistency across both stacks.

Current Behavior

The Servlet stack returns a WWW-Authenticate header containing the additional Bearer challenge metadata defined by RFC 9728.

For example:

WWW-Authenticate: Bearer resource_metadata="https://example.com/.well-known/oauth-protected-resource"

However, the Reactive stack still returns only:

WWW-Authenticate: Bearer

As a result, equivalent applications built on the Servlet and Reactive stacks produce different default authentication challenge responses.

Context

This appears to be an inconsistency between the Servlet and Reactive implementations.

Relevant references:

• RFC 9728 (OAuth 2.0 Protected Resource Metadata), Section 5.1 – WWW-Authenticate Response:
  https://www.rfc-editor.org/rfc/rfc9728

• Servlet implementation (BearerTokenAuthenticationEntryPoint):
  https://docs.spring.io/spring-security/reference/api/java/org/springframework/security/oauth2/server/resource/web/BearerTokenAuthenticationEntryPoint.html

• Reactive implementation (BearerTokenServerAuthenticationEntryPoint):
  https://docs.spring.io/spring-security/reference/api/java/org/springframework/security/oauth2/server/resource/web/server/BearerTokenServerAuthenticationEntryPoint.html

Would it make sense to align the Reactive implementation with the Servlet implementation so that both produce the same default WWW-Authenticate header?

Start with BearerTokenServerAuthenticationEntryPoint and compare its default WWW-Authenticate behavior with the referenced BearerTokenAuthenticationEntryPoint. Use RFC 9728 Section 5.1 and the example header as the acceptance criteria. Done means equivalent Servlet and Reactive applications produce the same default Bearer challenge metadata.