Which header field must a server include when it responds 401 (Unauthorized)?
Retry-After, indicating when credentials may be presented again
Proxy-Authenticate, with at least one challenge
WWW-Authenticate, with at least one challenge applicable to the target resource✓پاسخ درست
Authorization
توضیح
A 401 without WWW-Authenticate violates a MUST, which is one practical way 401 differs from 403: 403 carries no such requirement and signals that the server refuses regardless of retrying with the same credentials. Proxy-Authenticate belongs to 407, not 401.