The request requires user authentication. The response {1945} must {2068,2616} MUST
include a WWW-Authenticate header field ({1945} Section 10.16 section {2068} 14.46 {2616} 14.47)
containing a challenge applicable to the requested resource. The
client {1945} may {2068,2616} MAY
repeat the request with a suitable Authorization header
field ({1945} Section 10.2 {2068,2616} section 14.8).
If the request already included Authorization credentials, then the 401
response indicates that authorization has been refused for those
credentials. If the 401 response contains the same challenge as the prior response,
and the user agent has already attempted
authentication at least once, then the user {1945} should {2068,2616} SHOULD
be presented the entity that was given in the response, since that
entity {1945} may {2068} MAY {2616} might
include relevant diagnostic information. HTTP access authentication is explained
in {1945} Section 11 {2068} section 11 {2616} "HTTP Authentication: Basic and Digest Access Authentication" [43] .
[422] RFC 2660 - The Secure HyperText Transfer Protocol
( ( 版))
http://tools.ietf.org/html/rfc2660#section-5.2.1
[20] Other Authentication Methods | GitHub API
( 版)
https://developer.github.com/v3/auth/
The main difference is that the RFC requires unauthenticated requests to be answered with 401 Unauthorized responses. In many places, this would disclose the existence of user data. Instead, the GitHub API responds with 404 Not Found. This may cause problems for HTTP libraries that assume a 401 Unauthorized response.
[29] Make navigate's resource handling more explicit
( (annevk著, ))
https://github.com/whatwg/html/commit/806bc62caaee78a696a6c929558a5b801cceeec4
[30] Move 401/407 into the network realm
(annevk著, )
https://github.com/whatwg/fetch/commit/ec6f5ef5f99cb6b0dd6c701b49791810fb380b04
[31] Make CORS-preflight fetches set the CORS flag
(annevk著, )
https://github.com/whatwg/fetch/commit/9334fcbd34dc17e4508582c9fdc57f20ba5b728e