The WWW-Authenticate response-header field MUST be included in 401 (Unauthorized) response messages.
The field value consists of at least one challenge that indicates the authentication scheme(s) and parameters applicable to the Request-URI.
The HTTP access authentication process is described in "HTTP Authentication: Basic and Digest Access Authentication". User agents are advised to take special care in parsing the WWW-Authenticate field value as it might contain more than one challenge, or if more than one WWW-Authenticate header field is provided, the contents of a challenge itself can contain a comma-separated list of authentication parameters.