Handle possible null HttpContext in ReplyForbiddenWithWwwAuthenticateHeaderAsync

[pmaytak]

Come up with a solution to handle possible null HttpContext in ReplyForbiddenWithWwwAuthenticateHeaderAsync in TokenAcquisition class.

microsoft-identity-web/src/Microsoft.Identity.Web/TokenAcquisition.cs

Lines 578 to 582 in 3c77e3c

	var httpResponse = CurrentHttpContext.Response;
	var headers = httpResponse.Headers;
	httpResponse.StatusCode = (int)HttpStatusCode.Forbidden;
	headers[HeaderNames.WWWAuthenticate] = new StringValues($"{Constants.Bearer} {parameterString}");

[jmprieur]

We should have an extra parameter with a default value of null.
If passed-in we'd use it in the method, otherwise we'd use the HttpContextAccessor as we do today.

public async Task ReplyForbiddenWithWwwAuthenticateHeaderAsync(
         IEnumerable<string> scopes,
         MsalUiRequiredException msalServiceException, 
         HttpContext httpContext = null)

Alternatively we could just pass-in the HttpResponse:

1. Pro this is all it needs
2. in term of usability this could be more complicated for customers to find they need to use HttpContext.Reponse ?

@jennyf19 @pmaytak what do you think?

We could also handle it automatically.

[jmprieur]

@pmaytak
Let's go with providing the HttpResponse as a parameter

This will also fix Azure devops Bug 1099665: Defect : CS8602, Component : src\Microsoft.Identity.Web\TokenAcquisition.cs (1 issue) and therefore assigning to you.

[jmprieur]

Updated the wiki:
https://github.com/AzureAD/microsoft-identity-web/wiki/Managing-incremental-consent-and-conditional-access#handling-incremental-consent-or-conditional-access-in-web-apis

cc: @pmaytak @jennyf19