diff -r 42114bf12da0 src/http/modules/ngx_http_auth_basic_module.c
--- a/src/http/modules/ngx_http_auth_basic_module.c	Mon Jun 16 19:43:25 2014 +0400
+++ b/src/http/modules/ngx_http_auth_basic_module.c	Wed Jul 02 11:25:45 2014 +0100
@@ -351,9 +351,24 @@ ngx_http_auth_basic_set_realm(ngx_http_r
 {
     size_t   len;
     u_char  *basic, *p;
+    ngx_table_elt_t **wwauth;
 
-    r->headers_out.www_authenticate = ngx_list_push(&r->headers_out.headers);
-    if (r->headers_out.www_authenticate == NULL) {
+    wwauth = r->headers_out.www_authenticate.elts;
+    if (wwauth == NULL) {
+        if (ngx_array_init(&r->headers_out.www_authenticate, r->pool,
+                           1, sizeof(ngx_table_elt_t *)) != NGX_OK) {
+            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        }
+    
+        wwauth = ngx_array_push(&r->headers_out.www_authenticate);
+        
+        if (wwauth == NULL) {
+            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        }
+    }
+
+    *wwauth = ngx_list_push(&r->headers_out.headers);
+    if (*wwauth == NULL) {
         return NGX_HTTP_INTERNAL_SERVER_ERROR;
     }
 
@@ -368,10 +383,10 @@ ngx_http_auth_basic_set_realm(ngx_http_r
     p = ngx_cpymem(p, realm->data, realm->len);
     *p = '"';
 
-    r->headers_out.www_authenticate->hash = 1;
-    ngx_str_set(&r->headers_out.www_authenticate->key, "WWW-Authenticate");
-    r->headers_out.www_authenticate->value.data = basic;
-    r->headers_out.www_authenticate->value.len = len;
+    (*wwauth)->hash = 1;
+    ngx_str_set(&(*wwauth)->key, "WWW-Authenticate");
+    (*wwauth)->value.data = basic;
+    (*wwauth)->value.len = len;
 
     return NGX_HTTP_UNAUTHORIZED;
 }
diff -r 42114bf12da0 src/http/modules/ngx_http_auth_request_module.c
--- a/src/http/modules/ngx_http_auth_request_module.c	Mon Jun 16 19:43:25 2014 +0400
+++ b/src/http/modules/ngx_http_auth_request_module.c	Wed Jul 02 11:25:45 2014 +0100
@@ -101,7 +101,7 @@ ngx_module_t  ngx_http_auth_request_modu
 static ngx_int_t
 ngx_http_auth_request_handler(ngx_http_request_t *r)
 {
-    ngx_table_elt_t               *h, *ho;
+    ngx_table_elt_t               *h, *ho, **hh;
     ngx_http_request_t            *sr;
     ngx_http_post_subrequest_t    *ps;
     ngx_http_auth_request_ctx_t   *ctx;
@@ -140,8 +140,11 @@ ngx_http_auth_request_handler(ngx_http_r
 
         if (ctx->status == NGX_HTTP_UNAUTHORIZED) {
             sr = ctx->subrequest;
-
-            h = sr->headers_out.www_authenticate;
+            h = NULL;
+            if (sr->headers_out.www_authenticate.elts != NULL) {
+                hh = sr->headers_out.www_authenticate.elts;
+                h = *hh;
+            }
 
             if (!h && sr->upstream) {
                 h = sr->upstream->headers_in.www_authenticate;
@@ -153,9 +156,21 @@ ngx_http_auth_request_handler(ngx_http_r
                     return NGX_ERROR;
                 }
 
+                hh = r->headers_out.www_authenticate.elts;
+                if (hh == NULL) {
+                    if (ngx_array_init(&r->headers_out.www_authenticate, r->pool,
+                                       1, sizeof(ngx_table_elt_t *)) != NGX_OK) {
+                        return NGX_ERROR;
+                    }
+
+                    hh = ngx_array_push(&r->headers_out.www_authenticate);
+                    if (hh == NULL) {
+                        return NGX_ERROR;
+                    }
+                }             
+
                 *ho = *h;
-
-                r->headers_out.www_authenticate = ho;
+                *hh = ho;
             }
 
             return ctx->status;
diff -r 42114bf12da0 src/http/ngx_http_core_module.c
--- a/src/http/ngx_http_core_module.c	Mon Jun 16 19:43:25 2014 +0400
+++ b/src/http/ngx_http_core_module.c	Wed Jul 02 11:25:45 2014 +0100
@@ -1101,7 +1101,9 @@ ngx_int_t
 ngx_http_core_access_phase(ngx_http_request_t *r, ngx_http_phase_handler_t *ph)
 {
     ngx_int_t                  rc;
+    ngx_uint_t                 i;
     ngx_http_core_loc_conf_t  *clcf;
+    ngx_table_elt_t           **wwauth;
 
     if (r != r->main) {
         r->phase_handler = ph->next;
@@ -1135,8 +1137,12 @@ ngx_http_core_access_phase(ngx_http_requ
         if (rc == NGX_OK) {
             r->access_code = 0;
 
-            if (r->headers_out.www_authenticate) {
-                r->headers_out.www_authenticate->hash = 0;
+            if (r->headers_out.www_authenticate.elts) {
+                wwauth = r->headers_out.www_authenticate.elts;
+
+                for (i = 0; i < r->headers_out.www_authenticate.nelts; i++) {
+                    wwauth[i]->hash = 0;
+                }
             }
 
             r->phase_handler = ph->next;
diff -r 42114bf12da0 src/http/ngx_http_request.h
--- a/src/http/ngx_http_request.h	Mon Jun 16 19:43:25 2014 +0400
+++ b/src/http/ngx_http_request.h	Wed Jul 02 11:25:45 2014 +0100
@@ -255,7 +255,6 @@ typedef struct {
     ngx_table_elt_t                  *last_modified;
     ngx_table_elt_t                  *content_range;
     ngx_table_elt_t                  *accept_ranges;
-    ngx_table_elt_t                  *www_authenticate;
     ngx_table_elt_t                  *expires;
     ngx_table_elt_t                  *etag;
 
@@ -268,6 +267,7 @@ typedef struct {
     ngx_uint_t                        content_type_hash;
 
     ngx_array_t                       cache_control;
+    ngx_array_t                       www_authenticate;
 
     off_t                             content_length_n;
     time_t                            date_time;
diff -r 42114bf12da0 src/http/ngx_http_upstream.c
--- a/src/http/ngx_http_upstream.c	Mon Jun 16 19:43:25 2014 +0400
+++ b/src/http/ngx_http_upstream.c	Wed Jul 02 11:25:45 2014 +0100
@@ -2010,7 +2010,7 @@ ngx_http_upstream_intercept_errors(ngx_h
 {
     ngx_int_t                  status;
     ngx_uint_t                 i;
-    ngx_table_elt_t           *h;
+    ngx_table_elt_t           *h, **wwauth;
     ngx_http_err_page_t       *err_page;
     ngx_http_core_loc_conf_t  *clcf;
 
@@ -2048,8 +2048,23 @@ ngx_http_upstream_intercept_errors(ngx_h
                 }
 
                 *h = *u->headers_in.www_authenticate;
-
-                r->headers_out.www_authenticate = h;
+                wwauth = r->headers_out.www_authenticate.elts;
+
+                if (wwauth == NULL) {
+                    if (ngx_array_init(&r->headers_out.www_authenticate,
+                                       r->pool, 1, 
+                                       sizeof(ngx_table_elt_t *)) != NGX_OK) {
+                        return NGX_ERROR;
+                    }
+
+                    wwauth = ngx_array_push(&r->headers_out.www_authenticate);
+
+                    if (wwauth == NULL) {
+                        return NGX_ERROR;
+                    }
+                }
+
+                *wwauth = h;
             }
 
 #if (NGX_HTTP_CACHE)