title: HTTP Authentication - WWW-Authenticate header - multiple realms
body: <p>Does anyone have any experience of supporting multiple realms in HTTP Authentication? </p>
  
  <p>The Microsoft website states: </p>
  
  <blockquote>
    <p>Each authenticate response header
    contains an available authentication
    scheme and a realm. If multiple
    authentication schemes are supported,
    the server returns multiple
    authenticate response headers. The
    realm value is case-sensitive and
    defines a protection space on the
    proxy or server. For example, the
    header "WWW-Authenticate: Basic
    Realm="example"" would be an example
    of a header returned when server
    authentication is required.</p>
  </blockquote>
  
  <p>This suggests that different areas of a website can be secured using different authentication methods. What we are confused about is how to determine what realm should be stated in the server response to a client request.  </p>
  
  <p>Does anyone have any examples of how multiple realms work?</p>