HTTP Authentication Challenge Parser API Parse supplied WWW-Authenticate or Proxy-Authenticate challenge occurrences into ordered generic schemes, token68 credentials or ordered auth-params.
Parse supplied WWW-Authenticate or Proxy-Authenticate challenge occurrences into ordered generic schemes, token68 credentials or ordered auth-params. Preserve original occurrence order in fieldValues; combine them with explicit inserted comma SP delimiters for list interpretation, including auth-param continuation across occurrences. Empty arrays mean absence; reasonable empty comma-list members and empty field occurrences are ignored during interpretation while original text is retained. Scheme and parameter comparisons are case-insensitive; repeated schemes remain separate challenges and duplicate parameter names within one challenge emit findings without discarding evidence. Token68 padding is retained without decoding. Quoted commas and quoted-pairs are interpreted only inside complete quoted strings; rawValue preserves quotes and escapes while value removes surrounding quotes and quoted-pair backslashes. Credentials require 1*SP after a scheme; HTAB is not a substitute, while OWS around list commas and BWS around parameter equals are accepted. Whole credential alternatives resolve generic realm= as token68, x=y as auth-param, and Negotiate as scheme-only; scheme-specific credential policy is outside scope. Field input accepts HTAB, visible ASCII and Latin-1 obs-text U+0080 through U+00FF; obs-text is accepted in quoted strings and quoted-pairs only. CR, LF, DEL, other controls and characters above U+00FF are rejected by schema. Offsets are zero-based half-open JavaScript string code-unit indexes into the declared combinedValue, never wire-byte offsets. Per-challenge sourceSpans use occurrence-local indexes and exact original lexical slices; combined lexical text can contain explicitly inserted delimiters. On syntax loss, retain only the completed challenge prefix and stop all later interpretation; malformed text remains in fieldValues and unparsedSuffix. Input workload interpretation is bounded to 256 challenges and 512 auth-params, with unsupported-profile and an uninterpreted suffix at that boundary; these are processing bounds, not payment limits. This RFC 9110 sections 11.1, 11.6.1, 11.7.1 and 5.6 profile does not decode token68, authenticate, validate credentials, contact servers, select schemes, assess scheme security or certify full HTTP messages. Use authorized, non-sensitive data. The report describes supplied records and does not change external systems.
Agent API guide → · Website orders show the report on your private order page.
Your input · JSON Load a small example The complete checkout request must fit within 40,000 UTF-8 bytes. Your input is validated again before an order is created.