{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/22666","repository_url":"https://api.github.com/repos/owncloud/core","labels_url":"https://api.github.com/repos/owncloud/core/issues/22666/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/22666/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/22666/events","html_url":"https://github.com/owncloud/core/issues/22666","id":136615877,"number":22666,"title":"No WWW-authenticate response header for HTTP PUT API requests","user":{"login":"martinrotter","id":1255302,"avatar_url":"https://avatars.githubusercontent.com/u/1255302?v=3","gravatar_id":"","url":"https://api.github.com/users/martinrotter","html_url":"https://github.com/martinrotter","followers_url":"https://api.github.com/users/martinrotter/followers","following_url":"https://api.github.com/users/martinrotter/following{/other_user}","gists_url":"https://api.github.com/users/martinrotter/gists{/gist_id}","starred_url":"https://api.github.com/users/martinrotter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinrotter/subscriptions","organizations_url":"https://api.github.com/users/martinrotter/orgs","repos_url":"https://api.github.com/users/martinrotter/repos","events_url":"https://api.github.com/users/martinrotter/events{/privacy}","received_events_url":"https://api.github.com/users/martinrotter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/core/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/owncloud/core/labels/comp:core","name":"comp:core","color":"d4c5f9"},{"url":"https://api.github.com/repos/owncloud/core/labels/sev2-high","name":"sev2-high","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/owncloud/core/milestones/72","html_url":"https://github.com/owncloud/core/milestones/9.0.1-current-maintenance","labels_url":"https://api.github.com/repos/owncloud/core/milestones/72/labels","id":1580707,"number":72,"title":"9.0.1-current-maintenance","description":"","creator":{"login":"cmonteroluque","id":879976,"avatar_url":"https://avatars.githubusercontent.com/u/879976?v=3","gravatar_id":"","url":"https://api.github.com/users/cmonteroluque","html_url":"https://github.com/cmonteroluque","followers_url":"https://api.github.com/users/cmonteroluque/followers","following_url":"https://api.github.com/users/cmonteroluque/following{/other_user}","gists_url":"https://api.github.com/users/cmonteroluque/gists{/gist_id}","starred_url":"https://api.github.com/users/cmonteroluque/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmonteroluque/subscriptions","organizations_url":"https://api.github.com/users/cmonteroluque/orgs","repos_url":"https://api.github.com/users/cmonteroluque/repos","events_url":"https://api.github.com/users/cmonteroluque/events{/privacy}","received_events_url":"https://api.github.com/users/cmonteroluque/received_events","type":"User","site_admin":false},"open_issues":88,"closed_issues":82,"state":"open","created_at":"2016-02-12T23:55:24Z","updated_at":"2016-03-16T15:53:58Z","due_on":"2016-04-05T04:00:00Z","closed_at":null},"comments":6,"created_at":"2016-02-26T07:06:40Z","updated_at":"2016-03-16T16:07:52Z","closed_at":null,"body":"NOTE: I reported this to news repo before. They said, I should report it here too.\r\n\r\n### Steps to reproduce\r\n1. Send ownCloud NEWS API request (for example via CURL).\r\n2. Check HTTP answer.\r\n3. No WWW-authenticate header inside the answer.\r\n\r\n### Expected behaviour\r\nThe HTTP/401 response MUST include WWW-authenticate header to indicate the kind of desired auth method.\r\n\r\n### Actual behaviour\r\nWhen someone sends /items/star/multiple request without BASIC auth credentials, HTTP 401 response does not contain WWW-authenticate header.\r\n\r\n**This is not standard behavior.** Server should always indicate which method of authentication it expects when authentication fails and 401 is returned. This literally breaks some existing libraries - for example Qt Network stack, where you have to explicitly append Authentication header and not to wait for server's answer. All API calls must return WWW-authenticate header when HTTP/401 response is returned.\r\n\r\nFrom standard RFC 1945:\r\n\r\n> 401 Unauthorized\r\n>\r\n>  The request requires user authentication. The response must include\r\n>  a WWW-Authenticate header field (Section 10.16) containing.......\r\n\r\n### Server configuration\r\n**Operating system**: Ubuntu 14.04\r\n\r\n**Web server:** Apache\r\n\r\n**Database:** MariaDB\r\n\r\n**PHP version:** 5.5\r\n\r\n**ownCloud version:** (see ownCloud admin page) 8.2 whatever\r\n\r\n**Updated from an older ownCloud or fresh install:** Official virtual image"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/197401171","html_url":"https://github.com/owncloud/core/issues/22666#issuecomment-197401171","issue_url":"https://api.github.com/repos/owncloud/core/issues/22666","id":197401171,"user":{"login":"PVince81","id":277525,"avatar_url":"https://avatars.githubusercontent.com/u/277525?v=3","gravatar_id":"","url":"https://api.github.com/users/PVince81","html_url":"https://github.com/PVince81","followers_url":"https://api.github.com/users/PVince81/followers","following_url":"https://api.github.com/users/PVince81/following{/other_user}","gists_url":"https://api.github.com/users/PVince81/gists{/gist_id}","starred_url":"https://api.github.com/users/PVince81/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PVince81/subscriptions","organizations_url":"https://api.github.com/users/PVince81/orgs","repos_url":"https://api.github.com/users/PVince81/repos","events_url":"https://api.github.com/users/PVince81/events{/privacy}","received_events_url":"https://api.github.com/users/PVince81/received_events","type":"User","site_admin":false},"created_at":"2016-03-16T16:07:52Z","updated_at":"2016-03-16T16:07:52Z","body":"Also missing on GET requests.\r\n\r\nI tried OC 8.0 and there is no such header either.\r\n\r\nSo it looks like this was never implemented in the first place ?"}}