Build the WWW-Authenticate header value for an auth failure (RFC 6750 §3 /
RFC 9728 §5.1). Always carries the resource_metadata URL when known, plus an
error/scope for token/scope failures. Every interpolated value is passed
through quoteParamValue so a client-controlled component (notably a reflected
Host header in the metadata URL) can never break out of its quoted-string.
Build the WWW-Authenticate header value for an auth failure (RFC 6750 §3 / RFC 9728 §5.1). Always carries the resource_metadata URL when known, plus an error/scope for token/scope failures. Every interpolated value is passed through quoteParamValue so a client-controlled component (notably a reflected Host header in the metadata URL) can never break out of its quoted-string.