fix(jwt): add missing www-authenticate headers

[nowNick]

Summary

When kong returns 401 Unauthorized response it should return WWW-Authenticate header with proper challenge. JWT auth was missing this header.

Related PRs:

• fix(hmac): add missing www-authenticate headers #11791
• fix(key-auth): add missing www-authenticate headers #11794
• fix(basic-auth): add missing www-authenticate headers #11795
• fix(ldap): add missing www-authenticate headers #11820
• fix(oauth2): add missing www-authenticate headers #11833

RFCs & Materials

• https://httpwg.org/specs/rfc7235.html#status.401
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate

Checklist

• The Pull Request has tests
• A changelog file has been created under changelog/unreleased/kong or skip-changelog label added on PR if changelog is unnecessary. README.md
• N/A There is a user-facing docs PR against https://github.com/Kong/docs.konghq.com - PUT DOCS PR HERE

Full changelog

• add WWW-Authenticate headxer to jwt 401 response

Issue reference

• Fix WWW-Authenticate header not present when Kong and plugins return HTTP status 401 #7772
• KAG-321

[brentos]

Should we also be setting realm and/or the error in the www-authenticate header? Example:

     WWW-Authenticate: Bearer realm="example",
                       error="invalid_token",
                       error_description="The access token expired"

[nowNick]

The RFC6750 - The OAuth 2.0 Authorization Framework: Bearer Token Usage describes that:

All challenges defined by this specification MUST use the auth-scheme
value "Bearer". This scheme MUST be followed by one or more
auth-param values. The auth-param attributes used or defined by this
specification are as follows. Other auth-param attributes MAY be
used as well.

So we MUST pass at least one auth-param value. Therefore I added error="invalid_token". However it also states that for requests without JWT token at all it should not add error code.

If the request lacks any authentication information (e.g., the client
was unaware that authentication is necessary or attempted using an
unsupported authentication method), the resource server SHOULD NOT
include an error code or other error information.

So I need two variables: www_authenticate_base to return for requests without jwt token and www_authenticate_with_error.