Subject: Question on Multiplicity of Authorization and WWW-Authenticate

From: Jan Algermissen <[email-masked]>
Date: Tue, 16 Apr 2013 13:55:07 +0200

Hi,

I was wondering whether there can be multiple Authorization headers in an HTTP request.

AFAIU does not address the question, so I turned to [2] which suggests that there can only be one Authorization header per request. Because Authorization does not have a list value format.

Is that interpretation correct?

I am wondering because I understand [1] to say that WWW-Authenticate can indeed be used multiple times. However, WWW-Authenticate also does not have a list value format but is also not listed as an exception in [2], as is Set-Cookie.

Can anyone clarify?

Jan

[1] http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-22
[2] http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-22#section-3.2.2

---

From: Julian Reschke <[email-masked]>
Date: Tue, 16 Apr 2013 14:05:41 +0200

On 2013-04-16 13:55, Jan Algermissen wrote:
> ...

WWW-Authenticate *does* use the list format, so yes, it can be repeated.

And no, Authorization does not.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Tue, 16 Apr 2013 14:34:41 +0200

On 2013-04-16 14:11, algermissen1971 wrote:
>
> On 16.04.2013, at 14:05, Julian Reschke <[email-masked]> wrote:
>
> Hmm, is that because the ',' separates the various challanges. So, WWW-Authenticate value is a list of the value of Authorization header, yes?
>
> Jan

It's because the ABNF uses the "#" list production. And yes, this 
implies that you can either use multiple header field instances, or 
separate multiple values by "," in a single header field.

Best regards, Julian