401 without WWW-Authenticate

401-no-www-authenticate · Auth & OAuth

Endpoint (Streamable HTTP)

https://chaos-mcp.thomascdnns.com/s/401-no-www-authenticate/mcp

On the wire — recorded from a real request

Symptom

what you'll observe

Client gets 401 but can't start OAuth — it has nowhere to discover the auth server.

Cause

what this reproduces

Server requires auth but omits the WWW-Authenticate header the MCP auth spec relies on.

Fix

how you'd resolve it

Return WWW-Authenticate: Bearer with a resource_metadata pointer on 401.

Try it with curl

bash

curl -sS -X POST \
  https://chaos-mcp.thomascdnns.com/s/401-no-www-authenticate/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "curl", "version": "1"}
    }
  }'