title: Why is the 'www-authenticate' header missing from when I call api from React application?
body: <p>I am calling a web api project from a React application. The api uses JWT for authentication. If the application supplies the API with an expired JWT token, it receives a 401 response as expected, but the 'www-authentication' header (which includes the message saying that the reason for the 401 is due to expired token) is missing.</p>
  
  <p>If I run Fiddler during the request and inspect the response, I can see the header is present:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Date: Wed, 22 Apr 2020 01:07:32 GMT
  Server: Kestrel
  Content-Length: 0
  WWW-Authenticate: Bearer error="invalid_token", error_description="The token expired at '04/21/2020 17:33:17'"
  Access-Control-Allow-Origin: *
  </code></pre>
  
  <p>But the response object on the error received by my React application (which is using axios to call the API) does not have the 'www-authenticate' header:</p>
  
  <p><a href="https://i.stack.imgur.com/ZxGoJ.png" rel="nofollow noreferrer">Response as shown in console</a></p>
  
  <p>Here is the calling code:</p>
  
  <pre><code>async function getAllParts() {
  
    const gpuUrl = urls.apiGetGpuUrl;
    const moboUrl = urls.apiGetMoboUrl;
    const cpuUrl =urls.apiGetCpuUrl;
    const ramUrl =urls.apiGetRamUrl;
  
    const requestOptions = {
      method: 'GET',
      headers: authHeader()
    };
  
    const gpuData = axios.get(gpuUrl, requestOptions);
    const moboData = axios.get(moboUrl, requestOptions);
    const cpuData = axios.get(cpuUrl, requestOptions);
    const ramData = axios.get(ramUrl, requestOptions);
    try{
      const response = await Promise.all([gpuData, moboData, cpuData, ramData]);
      return handleMultipleResponses(response);
    } catch(error){
      console.log(error); // This error contains a response object with no 'www-authenticate' header
    }  
  }
  </code></pre>
  
  <p>As mentioned, I can see from Fiddler that the response does contain the header, but how can I access it from my application? Calling the API from postman produces an expected result with the header present:</p>
  
  <p><a href="https://i.stack.imgur.com/sNWVZ.png" rel="nofollow noreferrer">Response as shown in Postman</a></p>
  
  <p>Any help would be greatly appreciated.</p>
  
  <p>EDIT:</p>
  
  <p>Just to add for clarification, in the calling code, the 'authHeader()' function sets the header as follows:</p>
  
  <pre><code>export function authHeader() {
    let user = JSON.parse(localStorage.getItem('user'));
    if (user &amp;&amp; user.token) {
        return { 'Authorization': 'Bearer ' + user.token };  //     
    } else {
        return {};
    }
  }
  </code></pre>
  
  <p>I believe this to be set correctly, as the data is successfully retrieved when the JWT has not expired.</p>