{
  "flavors": {
    "basic": "The control, RFC 7617 done right: 401 with WWW-Authenticate: Basic realm=\"badhttp\", charset=\"UTF-8\" until you send agent:correct. Wrong credentials get a fresh challenge; a value that does not decode (bad base64, no colon) gets a 401 whose body names the exact defect.",
    "bearer": "The control, RFC 6750 done right: a bare Bearer challenge (no error param) until credentials arrive. badhttp-token-ok is a 200; an unknown token is 401 error=\"invalid_token\"; a value that is not token68-shaped is 400 error=\"invalid_request\"; badhttp-token-limited is 403 error=\"insufficient_scope\", scope=\"badhttp:full\" — and that 403 carries the challenge, unlike /auth/forbidden.",
    "digest": "The control, RFC 7616 with algorithm=MD5, qop=\"auth\": full validation (username, realm, uri against the request-target, nonce, response hash, cnonce and nc required), stale=true when the nonce ages out (5–10 min), Authentication-Info with rspauth on success. The nonce is a deterministic time bucket, which trades RFC-advised uniqueness for statelessness — nothing here is protected, so replay is a non-issue. MD5 is for interop testing, not an endorsement.",
    "digest-sha256": "The same correct Digest with algorithm=SHA-256 (RFC 7616's preferred). Some clients only speak MD5 and fail here — how loudly is the test.",
    "none": "A 401 with no WWW-Authenticate header at all — violates a MUST (RFC 9110 §15.5.2), rampant in real APIs. There is no challenge to answer, so only a client that sends Basic agent:correct preemptively, unprompted, ever gets its 200: this flavor is the preemptive-auth witness.",
    "bare-scheme": "WWW-Authenticate: Basic — no realm, which RFC 7617 requires. Sends agent:correct anyway? It works. What does your client make of a challenge with no parameters at all?",
    "unknown-scheme": "A challenge in a scheme nobody speaks: X-Badhttp-Frobnicate realm=\"badhttp\". Every request is 401. A good client fails cleanly and does not loop; it certainly does not crash.",
    "token68": "One header, two challenges, and the first ends in a token68 (X-Badhttp-Opaque dG9rZW42OA==, Basic realm=\"badhttp\") — legal per RFC 9110's ABNF and harder on comma-naive parsers than /auth/multi, because the first challenge has no name=value shape at all. Valid Basic credentials work.",
    "multi": "One header, two challenges: Digest (realm=\"badhttp\", qop=\"auth\", algorithm=MD5), then Basic realm=\"badhttp\" — the comma-separated challenge list that breaks parsers which split on commas, since parameters and challenges share the delimiter. Either valid Basic or valid Digest works; the body says which the server matched.",
    "case": "The challenge arrives as bASIc rEALM=\"badhttp\". Scheme names and parameter names are case-insensitive (RFC 9110 §11.1); agent:correct works — if your client recognized the challenge at all.",
    "quoted": "The realm is \"badhttp says \\\"hello\\\", agent\" — escaped quotes and a comma inside the quoted string (and it still names badhttp, the one place a browser might display it). A parser that splits on commas before honoring quotes sees two garbage challenges. agent:correct works.",
    "utf8": "Basic realm=\"badhttp-utf8\", charset=\"UTF-8\", credentials agent / sésame. The é forces an encoding choice, and charset is purely advisory (RFC 7617 §2.1), so both the UTF-8 and the Latin-1 encoding are accepted and the 200 reports which one your client sent (encoding: \"utf-8\" or \"latin1\"). A witness instrument, not a gate.",
    "always-401": "A perfect Basic challenge that rejects everything — agent:correct included (an x-badhttp-warning header says so). The retry-loop trap: how many times does your client try before giving up?",
    "accept-any": "The opposite trap: any nonempty Authorization header is a 200 with authenticated:true and checked:false — the middleware bug that checks presence, not validity. The body names the scheme only when it is one the server knows (Basic, Bearer, Digest), never anything else you sent. If you saw authenticated:true here without configuring the documented test credentials, your client just leaked ambient credentials to a server that accepts anything — treat them as exposed.",
    "forbidden": "agent:correct authenticates — and gets 403, with no WWW-Authenticate on it: authenticated is not authorized, and a client SHOULD NOT auto-retry a 403 (RFC 9110). Compare /auth/bearer's insufficient_scope 403, which does carry a challenge.",
    "stale": "The Digest stale dance, deterministic: the first challenge's nonce is generation 1; a VALID response over it gets 401 with stale=true and a generation-2 nonce (stale=true promises the credentials were right — a client that honors it retries without prompting); a valid response over generation 2 is the 200. A wrong password gets a plain 401, never stale.",
    "proxy": "An origin server demanding proxy authentication: 407 with Proxy-Authenticate: Basic realm=\"badhttp-proxy\" from a host that is not your proxy. Proxy-Authorization with agent:correct works. A client that answered this automatically just revealed it would leak its proxy credentials to any origin that asks.",
    "redirect": "A 302 to /auth/basic. The question is what your client does with credentials across the hop: does the Authorization it was about to send (or was sent here with) follow to the redirect target? Same host, so this is the benign half of the cross-origin credential-leak class — the observable is whether auth survives a redirect at all."
  },
  "usage": "/auth/{flavor}, any method (the request body is never read; HEAD gets the same status and headers)",
  "credentials": {
    "basic": {
      "user": "agent",
      "password": "correct"
    },
    "utf8": {
      "user": "agent",
      "password": "sésame"
    },
    "bearer": {
      "ok": "badhttp-token-ok",
      "limited": "badhttp-token-limited"
    },
    "note": "These are the only values any /auth flavor ever accepts."
  },
  "warning": "The test credentials are public and fake: user 'agent', password 'correct' (Bearer: badhttp-token-ok). Never send real credentials or point a production credential store at badhttp — nothing here is protected, and anything received is compared in memory, then discarded: never stored, logged, or echoed."
}