Proper HTTP headers for login success / fail responses?

http httpresponse
unicorn_crack picture unicorn_crack · Aug 15, 2011 · Viewed 10.8k times · Source

Are there any standards for using HTTP headers for login success / fail responses?

Answer

uncovery picture uncovery · Aug 17, 2011

The header that the server sends is either the 200 OK or 401 denied status codes on success or failure.

See http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html Section 10.4.2 401 Unauthorized for this.

When sending the 401, the server must send a

WWW-Authenticate = "WWW-Authenticate" ":" 1#challenge

to indicate what scheme should be used to authenticate.

See http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html Section 14.47 WWW-Authenticate for this.

Related questions

.NET: Simplest way to send POST with data and read response

To my surprise, I can't do anything nearly as simple as this, from what I can tell, in the .NET BCL: byte[] response = Http.Post ( url: "http://dork.com/service", contentType: "application/x-www-form-urlencoded", contentLength: 32, content: "home=Cosby&favorite+flavor=…

Read More
What does it mean when an HTTP request returns status code 0?

What does it mean when JavaScript network calls such as fetch or XMLHttpRequest, or any other type of HTTP network request, fail with an HTTP status code of 0? This doesn't seem to be a valid HTTP status code as other …

Read More
Uses of content-disposition in an HTTP response header

I have found the following asp.net code to be very useful when serving files from a database: Response.AppendHeader("content-disposition", "attachment; filename=" + fileName); This lets the user save the file to their computer and then decide how to use …

Read More