www-authenticate

What it is and what it does

www-authenticate is a small, dependency-free library that parses the WWW-Authenticate HTTP response header into an OrderedDict structure. The header itself is notoriously difficult to parse correctly because it mixes comma-separated challenges with comma-separated parameters, and real-world servers often violate the specification—some omit parameters entirely, and the Negotiate scheme uses a bare string instead of name-value pairs. This library abstracts away those parsing complexities.

You pass it a WWW-Authenticate header string and get back a dictionary keyed by authentication scheme name (e.g., 'Basic', 'Digest', 'Negotiate'). The values are either dictionaries of parameters, a single string, or None depending on the challenge structure. It's useful in any HTTP client or middleware that needs to inspect authentication requirements from a server response.

Use it for:

• Extract the realm from a Basic authentication challenge to display a login prompt with the correct scope.
• Check which authentication schemes a server supports and select the strongest one your client can handle.
• Parse Negotiate challenges in a Kerberos or SPNEGO authentication flow without manual string splitting.
• Build an HTTP client that adapts its auth strategy based on the server's WWW-Authenticate response.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses WWW-Authenticate HTTP headers into structured challenge data, handling the ambiguities and edge cases that make manual parsing error-prone.

No. The package is abandoned (last release 2015-08-05, no commits since 2019-08-14) and has high install friction. While it solves a real parsing problem and carries no known vulnerabilities, the lack of maintenance means it will not be updated for Python compatibility issues, security patches, or spec changes. For new projects, consider writing a small inline parser or using a maintained HTTP library's built-in authentication handling.

Install

www-authenticate on PyPI

pip install www-authenticate

uv add www-authenticate

poetry add www-authenticate

Installing www-authenticate

Before you install

High install friction due to source-only distribution. Package is abandoned—last release was 2015-08-05 and last commit 2019-08-14. No maintenance activity since then. No external dependencies, but stagnation means security issues or Python compatibility problems would not be addressed.

License in practice

BSD license is permissive; you may use, modify, and distribute this code freely with minimal restrictions, making it safe to embed in commercial or proprietary projects.

Quickstart

import www_authenticate

parsed = www_authenticate.parse(response.headers['WWW-Authenticate'])
if 'Basic' in parsed:
    realm = parsed['Basic']['realm']

No external dependencies, but Python version compatibility is unspecified and untested on modern versions given the package's abandonment.

Verify before relying

• Whether the package works correctly on Python versions released after 2019.
• Whether parsing handles all real-world WWW-Authenticate header variations encountered in modern HTTP clients and servers.

Package facts

Evidence: www-authenticate-0.9.2.tar.gz

Tags

More WWW/HTTP packages