---
id: www-authenticate
version: "0.9.2"
license: BSD
license_treatment: permissive
maintenance: abandoned
---

# www-authenticate — Parser for WWW-Authenticate headers.

License: permissive · Maintenance: abandoned · Downloads: 689.7K/mo

## What it is and what it does

www-authenticate is a small, dependency-free library that parses the WWW-Authenticate HTTP response header into an OrderedDict structure. The header itself is notoriously difficult to parse correctly because it mixes comma-separated challenges with comma-separated parameters, and real-world servers often violate the specification—some omit parameters entirely, and the Negotiate scheme uses a bare string instead of name-value pairs. This library abstracts away those parsing complexities.

You pass it a WWW-Authenticate header string and get back a dictionary keyed by authentication scheme name (e.g., 'Basic', 'Digest', 'Negotiate'). The values are either dictionaries of parameters, a single string, or None depending on the challenge structure. It's useful in any HTTP client or middleware that needs to inspect authentication requirements from a server response.

Use it for:

- Extract the realm from a Basic authentication challenge to display a login prompt with the correct scope.
- Check which authentication schemes a server supports and select the strongest one your client can handle.
- Parse Negotiate challenges in a Kerberos or SPNEGO authentication flow without manual string splitting.
- Build an HTTP client that adapts its auth strategy based on the server's WWW-Authenticate response.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses WWW-Authenticate HTTP headers into structured challenge data, handling the ambiguities and edge cases that make manual parsing error-prone.

No. The package is abandoned (last release 2015-08-05, no commits since 2019-08-14) and has high install friction. While it solves a real parsing problem and carries no known vulnerabilities, the lack of maintenance means it will not be updated for Python compatibility issues, security patches, or spec changes. For new projects, consider writing a small inline parser or using a maintained HTTP library's built-in authentication handling.

## Install

pip install www-authenticate
uv add www-authenticate
poetry add www-authenticate

## Installing www-authenticate

Before you install: High install friction due to source-only distribution. Package is abandoned—last release was 2015-08-05 and last commit 2019-08-14. No maintenance activity since then. No external dependencies, but stagnation means security issues or Python compatibility problems would not be addressed.

License in practice: BSD license is permissive; you may use, modify, and distribute this code freely with minimal restrictions, making it safe to embed in commercial or proprietary projects.

Quickstart:

import www_authenticate

parsed = www_authenticate.parse(response.headers['WWW-Authenticate'])
if 'Basic' in parsed:
    realm = parsed['Basic']['realm']

No external dependencies, but Python version compatibility is unspecified and untested on modern versions given the package's abandonment.

Verify before relying:

- Whether the package works correctly on Python versions released after 2019.
- Whether parsing handles all real-world WWW-Authenticate header variations encountered in modern HTTP clients and servers.

## Package facts

- License: BSD (permissive)
- Python support: unspecified
- Install friction: high
- Maintenance: abandoned
- Downloads: 689.7K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

WWW-Authenticate header parser, HTTP authentication challenge parsing, parse www-authenticate header, basic digest negotiate auth parsing, http auth header parser, http-auth, abandoned

[View on SkillFed](https://skillfed.io/packages/www-authenticate) · [View on PyPI](https://pypi.org/project/www-authenticate/)