Function buildWWWAuthenticateHeader

coderd/httpmw/apikey.go:840–872

Test export functions for testing package access buildWWWAuthenticateHeader constructs RFC 6750 + RFC 9728 compliant WWW-Authenticate header

(accessURL *url.URL, r *http.Request, code int, response codersdk.Response)

// buildWWWAuthenticateHeader constructs RFC 6750 + RFC 9728 compliant WWW-Authenticate header
func buildWWWAuthenticateHeader(accessURL *url.URL, r *http.Request, code int, response codersdk.Response) string {
	// Use the configured access URL for resource metadata
	if accessURL == nil {
		scheme := "https"
		if r.TLS == nil {
			scheme = "http"
		}

		// Use the Host header to construct the canonical audience URI
		accessURL = &url.URL{
			Scheme: scheme,
			Host:   r.Host,
		}
	}

	resourceMetadata := accessURL.JoinPath("/.well-known/oauth-protected-resource").String()

	switch code {
	case http.StatusUnauthorized:
		switch {
		case strings.Contains(response.Message, "expired") || strings.Contains(response.Detail, "expired"):
			return fmt.Sprintf(`Bearer realm="coder", error="invalid_token", error_description="The access token has expired", resource_metadata=%q`, resourceMetadata)
		case strings.Contains(response.Message, "audience") || strings.Contains(response.Message, "mismatch"):
			return fmt.Sprintf(`Bearer realm="coder", error="invalid_token", error_description="The access token audience does not match this resource", resource_metadata=%q`, resourceMetadata)
		default:
			return fmt.Sprintf(`Bearer realm="coder", error="invalid_token", error_description="The access token is invalid", resource_metadata=%q`, resourceMetadata)
		}
	case http.StatusForbidden:
		return fmt.Sprintf(`Bearer realm="coder", error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token", resource_metadata=%q`, resourceMetadata)
	default:
		return fmt.Sprintf(`Bearer realm="coder", resource_metadata=%q`, resourceMetadata)
	}
}

// extractExpectedAudience determines the expected audience for the current request.
// This should match the resource parameter used during authorization.