Fix sending challenge for multiple authenticators
When using multiple authentication methods such as PASSWORD and JWT,
the WWW-Authenticate challenge was only sent for the last method
rather than all of them. This breaks authentication for clients
that do not pre-authenticate requests.
@@ -96,7 +96,7 @@ public class AuthenticationFilter
skipRequestBody(request);
for (String value : authenticateHeaders) {
- response.setHeader(WWW_AUTHENTICATE, value);
+ response.addHeader(WWW_AUTHENTICATE, value);
}
if (messages.isEmpty()) {
