The response says Unauthorized.

highlighted = computed this step

The response status is Unauthorized

The status row is the server's challenge answer.

401 Unauthorized401\ \text{Unauthorized}
Unauthorized statusThe missing Authorization request, challenge response, and checks are recomputed from pinned bytes.Unauthorized status - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty

The response body is empty

Content-Length is 0, so the challenge is carried by headers.

body bytes=0\text{body bytes}=0
Unauthorized statusThe missing Authorization request, challenge response, and checks are recomputed from pinned bytes.Unauthorized status - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty

The status asks for credentials

The next row to read is the challenge header that names the auth scheme.

read challenge header\text{read challenge header}
Unauthorized statusThe missing Authorization request, challenge response, and checks are recomputed from pinned bytes.Unauthorized status - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty

Summary

The Unauthorized response is a header-only prompt in this toy example.

status checked\text{status checked}
Unauthorized statusThe missing Authorization request, challenge response, and checks are recomputed from pinned bytes.Unauthorized status - GET /private has no Authorization; response 401 Unauthorized names Basicsectionnamevaluecheckrequest linemethodGETparsedrequest linepath/privateparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorizationabsentabsentstatusversionHTTP/1.1parsedstatusstatus401 UnauthorizedchallengeheaderWWW-AuthenticateBasic realm toysafe display formheaderContent-Length0empty bodybodybyte length0countedchallengeschemeBasicparsedchallengerealm displaytoyparsedcheckAuthorization headerabsentmissingcheckstatus401 Unauthorizedchallengecheckchallenge schemeBasicBasiccheckrealmtoytoychecksent body bytes0empty