How can I include some additional headers every time server needs to send 401 responses? I tried adding it in Magento\Framework\Controller\Result\Json render() method like:

if ($response->getHttpResponseCode() == 401)
            $response->setHeader('WWW-Authenticate','/V1/integration/admin/token', true);

But that did not worked.

So I tried adding it in Magento\Framework\App\Response\HTTP in setNoCacheHeaders(), setPrivateHeaders() and setPublicHeaders() like:

if ($response->getHttpResponseCode() == 401)
            $response->setHeader('WWW-Authenticate','/V1/integration/admin/token', true);

But that did not worked as well. Any ideas?

1 Answer 1


Ok, i added this:

if ($this->getStatusCode() == 401)
        $this->setHeader('WWW-Authenticate', 'basic');

In \Magento\Framework\Webapi\Rest\Response.php class at the end of _renderMessages() and that works fine but it is not practice to directly change core functionality. So i made modul Rewriter. Made etc/di.xml that looks like:

  <?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <preference for="Magento\Framework\Webapi\Rest\Response" type="Sdu\Rewriter\Rest\Response" />

And made new Response.php class in this new module:

namespace Sdu\Rewriter\Rest;

class Response extends \Magento\Framework\Webapi\Rest\Response
   public function _renderMessages()
       $responseHttpCode = null;
       /** @var \Exception $exception */
       foreach ($this->getException() as $exception) {
           $maskedException = $this->_errorProcessor->maskException($exception);
           $messageData = [
               'message' => $maskedException->getMessage(),
           if ($maskedException->getErrors()) {
               $messageData['errors'] = [];
               foreach ($maskedException->getErrors() as $errorMessage) {
                   $errorData['message'] = $errorMessage->getRawMessage();
                   $errorData['parameters'] = $errorMessage->getParameters();
                   $messageData['errors'][] = $errorData;
           if ($maskedException->getCode()) {
               $messageData['code'] = $maskedException->getCode();
           if ($maskedException->getDetails()) {
               $messageData['parameters'] = $maskedException->getDetails();
           if ($this->_appState->getMode() == \Magento\Framework\App\State::MODE_DEVELOPER) {
               $messageData['trace'] = $exception instanceof \Magento\Framework\Webapi\Exception
                   ? $exception->getStackTrace()
                   : $exception->getTraceAsString();
           $responseHttpCode = $maskedException->getHttpCode();
       // set HTTP code of the last error, Content-Type, and all rendered error messages to body
       if ($this->getStatusCode() == 401)
           $this->setHeader('WWW-Authenticate', 'basic');
       return $this;

You can see added to lines at the end of method.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.