Per RFC 2617 : For Authorization header, syntax should be qop = auth For WWW-Authenticate and Proxy-Authenticate headers, syntax should be qop = "auth"