WWW-Authenticate response header is missing about passport

[lkavicky]

Passport does automatically set the WWW-Authenticate header when all strategies failed if you provide no callback to the authenticate method (implementation here)
nestjs/passport always provides the callback:

passport/lib/auth.guard.ts

Line 102 in 1034455

passport.authenticate(type, options, (err, user, info, status) => {

So that functionality is not accessible when using nestjs/passport.
You get the challenges passport uses to generate the WWW-Authenticate header in callback's 3rd parameter (info), but nestjs/passport is not doing anything with that param:

passport/lib/auth.guard.ts

Lines 79 to 84 in 1034455

	handleRequest(err, user, info, context, status): TUser {
	if (err || !user) {
	throw err || new UnauthorizedException();
	}
	return user;
	}

[Jtalk]

I think this should be reopened. I've just spent an hour, and then some, debugging nestjs-passport over this specific issue.

As @lkavicky has correctly pointed out, passport does set WWW-Authenticate, but Nest.js uses the callback flow, which is passport-speak for "Hold my beer, I'll deal with it myself". Failing to then deal with it is a 100% bug.

The behaviour of Nest.js Passport is also not RFC-compliant now: WWW-Authenticate is mandatory for 401 Unauthorized (i.e. the MUST thing vs SHOULD thing).

Right now we have to maintain our own AuthGuard with patches around it (calling setHeader in handleRequest, because we're HTTP-only). I'm happy to contribute it upstream if you guys want it.

@jmcdo29 @kamilmysliwiec

[jmcdo29]

Does passport normally do this with express? @nestjs/passport is only a wrapper around passport with funcitonality to make it work in a nest-like fashion. If this doesn't happen automatically by passport, then @nestjs/passport won't do it either