Re:Usage Plans for AWS API Gateway
by x_foo_x on Thursday August 11, 2016 @01:33PM
(#12270160)
I use a custom authorizer with Auth0 and it works fine. I guess some systems still use Basic Auth though.
[ Parent
| on HN ]
Re:Usage Plans for AWS API Gateway
by colanderman on Thursday August 11, 2016 @01:39PM
(#12270212)
WWW-Authenticate is a requirement of HTTP itself, not Basic Auth. Returning 401 without this header (which API Gateway does) violates RFC 7235. It is the means by which HTTP negotiates an authentication protocol; without it, there is no way for authentication to proceed except by guessing.