Incorrect parameter delimiter in JWT plugin `WWW-Authenticate` header

[dingjiayi]

Is there an existing issue for this?

• I have searched the existing issues

Kong version ($ kong version)

3.9

Description

I noticed that the WWW-Authenticate header in JWT plugin uses spaces to separate parameters.

kong/kong/plugins/jwt/handler.lua

Line 161 in ed117a6

local www_authenticate_with_error = www_authenticate_base .. ' error="invalid_token"'

According to RFC 7235 (HTTP Authentication) (Section 4.1), the parameters in authentication headers should be comma-delimited.

... and each challenge can contain a comma-separated list of authentication parameters.

The correct format should be:
WWW-Authenticate: Bearer realm="auth-server", error="invalid_token"
(Note the comma , between realm and error parameters.)

If I misunderstood the RFC’s requirements for header formatting, kindly clarify or correct me.