HttpBearer::challenge() produces invalid WWW-Authenticate header (violates RFC 6750)

[Sakanweb]

Bug description

HttpBearer::challenge() emits a malformed WWW-Authenticate response header because it
interpolates $this->headerName (which equals "Authorization") instead of the literal
authentication scheme "Bearer".

Steps to reproduce

1. Configure HttpBearer as an authentication method.
2. Send a request without a valid token.
3. Inspect the WWW-Authenticate header in the 401 response.

Current behavior

// src/Method/HttpBearer.php, line 28
return $response->withHeader(Header::WWW_AUTHENTICATE, "{$this->headerName} realm=\"{$this->realm}\"");
$this->headerName is Header::AUTHORIZATION = "Authorization", so the response header is:

WWW-Authenticate: Authorization realm="api"
Authorization is not a registered authentication scheme — no compliant HTTP client (browsers, curl, OAuth libraries) will recognize or process this challenge.

Expected behavior
Per RFC 6750 §3, the header must be:

WWW-Authenticate: Bearer realm="api"
Contrast with HttpBasic
HttpBasic::challenge() hardcodes the scheme name correctly:

// src/Method/HttpBasic.php, line 61
return $response->withHeader(Header::WWW_AUTHENTICATE, "Basic realm=\"{$this->realm}\"");
HttpBearer must do the same — hardcode "Bearer", not reuse $headerName.

Root cause
$headerName is the request header name from which the token is extracted (Authorization). challenge() needs the authentication scheme name (Bearer). These are two different concepts; conflating them is the defect.

Proposed fix

public function challenge(ResponseInterface $response): ResponseInterface
{
    return $response->withHeader(Header::WWW_AUTHENTICATE, "Bearer realm=\"{$this->realm}\"");
}

One-line change, no BC break.

References
RFC 6750 §3 — The WWW-Authenticate Response Header Field
RFC 7235 §4.1 — WWW-Authenticate
Environment
Package: yiisoft/auth
File: src/Method/HttpBearer.php
PHP: 8.0+

[samdark]

Fixed. Thanks.