Ask Without Credentials

Missing Authorization

The request arrives without credentials.

highlighted = computed this step

The request asks for the private path

The request line asks for the same toy private path as the Basic auth example.

GET /private\text{GET /private}
Missing AuthorizationThe missing Authorization request, challenge response, and checks are recomputed from pinned bytes.Missing Authorization - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty

Authorization is absent

The request rows show no Authorization header.

Authorization absent\text{Authorization absent}
Missing AuthorizationThe missing Authorization request, challenge response, and checks are recomputed from pinned bytes.Missing Authorization - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty

The Host row names api.example

The server can answer the request even before credentials are supplied.

Host=api.example\text{Host}=\text{api.example}
Missing AuthorizationThe missing Authorization request, challenge response, and checks are recomputed from pinned bytes.Missing Authorization - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty

Summary

A request without Authorization can be answered with a challenge.

missing Authorization checked\text{missing Authorization checked}
Missing AuthorizationThe missing Authorization request, challenge response, and checks are recomputed from pinned bytes.Missing Authorization - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty