🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Support `WWW-Authenticate` header for auth classes (#1334)


https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/WWW-Authenticate
RFC: https://www.rfc-editor.org/rfc/rfc9110.html#section-15.5.2

Quote:

The server generating a 401 response MUST send a WWW-Authenticate header field (Section 11.6.1) containing at least one challenge applicable to the target resource.
If the request included authentication credentials, then the 401 response indicates that authorization has been refused for those credentials. The user agent MAY repeat the request with a new or replaced Authorization header field (Section 11.6.2). If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user agent SHOULD present the enclosed representation to the user, since it usually contains relevant diagnostic information.

Currently, we don't support this. But, we probably should.
Ideas on how to support this are welcome.

Criteria:

1. All auth classes should be supported, if some can't be supported, we need to figure out - why
2. It should be documented as a feature and what is supported
3. There should be a way to disable this (probably?)

#feature #good_first_issue #help_wanted #opensource_september #django_modern_rest
sent via relator