Repository navigation
Composite::challenge() overwrites WWW-Authenticate headers instead of accumulating them #124
Description
Summary
Yiisoft\Auth\Method\Composite::challenge() uses withHeader() for each method. When multiple authentication methods are configured, only the last WWW-Authenticate value remains.
Expected
Multiple challenges should be returned, e.g.:
WWW-Authenticate: Bearer realm="api"
WWW-Authenticate: Basic realm="api"Actual
Only the last method's challenge survives:
WWW-Authenticate: Basic realm="api"
Reproduce
$composite = new Composite([
new HttpBearer($repository),
new HttpBasic($repository),
]);
$response = $composite->challenge($responseFactory->createResponse(401));
// count($response->getHeader('WWW-Authenticate')) === 1
// value: "Basic realm=\"api\"" (or "Authorization realm=\"api\"" on 3.2.1, see #116)
HTTP check without credentials against a route protected by this Composite:
curl -sI https://example.test/protected | grep -i www-authenticate
# WWW-Authenticate: Basic realm="api"
Cause
foreach ($this->methods as $method) {
$response = $method->challenge($response); // uses withHeader() → overwrites
}Suggested fix
Accumulate challenges with withAddedHeader() (or equivalent), so each method can add its own WWW-Authenticate value.
Environment
Package: yiisoft/auth
Version: 3.2.1
Class: Yiisoft\Auth\Method\Composite
Activity
samdark commentedon Aug 6, 2026
Thanks for reporting. The issue is valid.
Using
withAddedHeader()for these challenges, plus a regression test combiningHttpBearerandHttpBasic, is an appropriate fix.Sakanweb commentedon Aug 7, 2026
Hey, thanks for the quick response!
I checked #125 — the
withAddedHeader()change fixes the overwrite I hit with Composite,and the new test covers it. Looks good to me 👍
Fix yiisoft#124: Fix `HttpBasic` and `HttpBearer` to add `WWW-Authent…