WWWAuthenticate
property WWWAuthenticate: string read write;
Example
procedure ScriptEvent(var Value: variant);
begin
if Response <> nil then
begin
Response.Realm := '';
Response.WWWAuthenticate := 'Bearer realm="Velox API"';
{ Configure the action's final outcome as 401. }
Value := Response.WWWAuthenticate;
end;
end;
Usage
WWWAuthenticate gets or sets a CRLF-delimited list of authentication challenges that Velox emits as separate WWW-Authenticate fields.
Additional Technical Info
WWWAuthenticate maps a script string to FResponseInfo.WWWAuthenticate.Text, where the native object is an Indy header list. Assigning the string parses line breaks into list entries; reading returns TStrings.Text, normally including CRLF separators and a trailing line break for nonempty content.
At header construction, Indy emits each nonempty entry as a separate WWW-Authenticate field. Use one complete challenge per line. A challenge itself can contain comma-separated authentication parameters, so a comma is not the delimiter between native list entries despite generic WebBroker wording.
This property alone does not change StatusCode. With Realm empty, the action's final result must be 401 for a normal authentication challenge response. With Realm nonempty, Indy forces 401; an explicit challenge list wins over its generated Basic challenge, while Realm still causes the status/body side effects.
An empty string clears the explicit challenge list. No scheme, token68, quoted-string, realm or control-character validation occurs. Build challenges only from trusted configuration with scheme-specific encoding; never include credentials or concatenate attacker-controlled text. Malformed challenges can prevent clients authenticating, and exposing detailed error parameters can leak security information.
The field advertises how a client can authenticate; it does not authenticate or authorise the current request. Test Response for nil.
External references
Created 2026-07-15