title: Customize WWW-Authenticate challenge header with Jwt Bearer Authentication middleware in WebAPI
body: <p>I'm using the JwtBearerAuthentication Katana middleware in a .NET WebAPI project to secure my web API via JWT.</p>
  
  <p>So, in my Startup class I'm just doing something simple like:</p>
  
  <pre><code> app.UseJwtBearerAuthentication(
              new JwtBearerAuthenticationOptions
              {
                  AuthenticationMode = AuthenticationMode.Active,
                  AllowedAudiences = new[] { audience },
                  IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                  {
                      new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
                  }
              });
  </code></pre>
  
  <p>Everything works great, with one exception.</p>
  
  <p>When a client passes in an invalid or missing Bearer token the WWW-Authenticate response header is just "Bearer". </p>
  
  <p>I'd like to customize that header to include the address of my authorization server and the supported grant types.</p>
  
  <p>Something more like: WWW-Authenticate: MyAuth href=url,grant_type="supported-grants" or whatever...</p>
  
  <p>What is the best way to do this? I'm surprised the JwtBearerAuthenticationOptions class does not include a Challenge property. I can work around this, but wanted to know if there is a best practice here with the Jwt middleware or not.</p>