diff --git a/.gitignore b/.gitignore
new file mode 100644
index 000000000..b04fff14a
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+# Visual Studio Code workspace options
+.vscode/settings.json
diff --git a/identity-server/Directory.Build.targets b/identity-server/Directory.Build.targets
index 7b3436797..a1f512d4c 100644
--- a/identity-server/Directory.Build.targets
+++ b/identity-server/Directory.Build.targets
@@ -27,6 +27,7 @@
         <!--tests -->
         <PackageReference Update="FluentAssertions" Version="6.5.1"/>
         <PackageReference Update="FluentAssertions.Web" Version="1.5.0"/>
+        <PackageReference Update="Shouldly" Version="4.2.1" />
         <PackageReference Update="Microsoft.NET.Test.Sdk" Version="17.8.0"/>
         <PackageReference Update="xunit" Version="2.9.0"/>
         <PackageReference Update="xunit.runner.visualstudio" Version="2.5.4" PrivateAssets="All"/>
diff --git a/identity-server/src/IdentityServer/Endpoints/Results/ProtectedResourceErrorResult.cs b/identity-server/src/IdentityServer/Endpoints/Results/ProtectedResourceErrorResult.cs
index ba73ef94f..f0504e8d5 100644
--- a/identity-server/src/IdentityServer/Endpoints/Results/ProtectedResourceErrorResult.cs
+++ b/identity-server/src/IdentityServer/Endpoints/Results/ProtectedResourceErrorResult.cs
@@ -9,6 +9,7 @@ using Microsoft.Extensions.Primitives;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Net.Http.Headers;
 using Duende.IdentityModel;
+using System.Collections.Generic;
 
 namespace Duende.IdentityServer.Endpoints.Results;
 
@@ -59,16 +60,24 @@ internal class ProtectedResourceErrorHttpWriter : IHttpResponseWriter<ProtectedR
             errorDescription = "The access token expired";
         }
 
-        var errorString = string.Format($"error=\"{error}\"");
-        if (errorDescription.IsMissing())
+        var values = new List<string>
         {
-            context.Response.Headers.Append(HeaderNames.WWWAuthenticate, new StringValues(new[] { "Bearer realm=\"IdentityServer\"", errorString }));
-        }
-        else
+            """
+            Bearer realm="IdentityServer"
+            """,
+            $"""
+             error="{error}"
+             """
+        };
+        
+        if (!errorDescription.IsMissing())
         {
-            var errorDescriptionString = string.Format($"error_description=\"{errorDescription}\"");
-            context.Response.Headers.Append(HeaderNames.WWWAuthenticate, new StringValues(new[] { "Bearer realm=\"IdentityServer\"", errorString, errorDescriptionString }));
+            values.Add($"""
+                        error_description="{errorDescription}"
+                        """);
         }
+        
+        context.Response.Headers.Append(HeaderNames.WWWAuthenticate, string.Join(",", values));
 
         return Task.CompletedTask;
     }
diff --git a/identity-server/test/Configuration.IntegrationTests/Configuration.IntegrationTests.csproj b/identity-server/test/Configuration.IntegrationTests/Configuration.IntegrationTests.csproj
index 2f225ae68..89291c4a0 100644
--- a/identity-server/test/Configuration.IntegrationTests/Configuration.IntegrationTests.csproj
+++ b/identity-server/test/Configuration.IntegrationTests/Configuration.IntegrationTests.csproj
@@ -23,6 +23,7 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="FluentAssertions" />
+    <PackageReference Include="Shouldly" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
diff --git a/identity-server/test/EntityFramework.IntegrationTests/EntityFramework.IntegrationTests.csproj b/identity-server/test/EntityFramework.IntegrationTests/EntityFramework.IntegrationTests.csproj
index 90ab0a162..7d232874c 100644
--- a/identity-server/test/EntityFramework.IntegrationTests/EntityFramework.IntegrationTests.csproj
+++ b/identity-server/test/EntityFramework.IntegrationTests/EntityFramework.IntegrationTests.csproj
@@ -9,6 +9,7 @@
         <PackageReference Include="xunit" />
         <PackageReference Include="xunit.runner.visualstudio" />
         <PackageReference Include="FluentAssertions" />
+        <PackageReference Include="Shouldly" />
 
         <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
         <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
diff --git a/identity-server/test/EntityFramework.Storage.IntegrationTests/EntityFramework.Storage.IntegrationTests.csproj b/identity-server/test/EntityFramework.Storage.IntegrationTests/EntityFramework.Storage.IntegrationTests.csproj
index 2eaec819d..75e1c0799 100644
--- a/identity-server/test/EntityFramework.Storage.IntegrationTests/EntityFramework.Storage.IntegrationTests.csproj
+++ b/identity-server/test/EntityFramework.Storage.IntegrationTests/EntityFramework.Storage.IntegrationTests.csproj
@@ -13,6 +13,7 @@
         <PackageReference Include="xunit" />
         <PackageReference Include="xunit.runner.visualstudio" />
         <PackageReference Include="FluentAssertions" />
+        <PackageReference Include="Shouldly" />
 
         <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
         <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
@@ -21,7 +22,7 @@
 
     <ItemGroup>
         <!-- The packages in this ItemGroup are all transitive dependencies that
-             would otherwise resolve to a version with a security vulnerabilitiy. 
+             would otherwise resolve to a version with a security vulnerability. 
              In future, we would like to update Microsoft.Data.SqlClient and
              Microsoft.EntityFrameworkCore, and remove these explicit dependencies
              (assuming that future versions of the intermediate dependencies that
@@ -36,4 +37,4 @@
         <ProjectReference Include="..\..\src\IdentityServer\Duende.IdentityServer.csproj" />
         <ProjectReference Include="..\..\src\Storage\Duende.IdentityServer.Storage.csproj" />
     </ItemGroup>
-</Project>
\ No newline at end of file
+</Project>
diff --git a/identity-server/test/EntityFramework.Storage.UnitTests/EntityFramework.Storage.UnitTests.csproj b/identity-server/test/EntityFramework.Storage.UnitTests/EntityFramework.Storage.UnitTests.csproj
index 567020cab..cd913bd74 100644
--- a/identity-server/test/EntityFramework.Storage.UnitTests/EntityFramework.Storage.UnitTests.csproj
+++ b/identity-server/test/EntityFramework.Storage.UnitTests/EntityFramework.Storage.UnitTests.csproj
@@ -6,6 +6,7 @@
 
     <ItemGroup>
         <PackageReference Include="FluentAssertions" />
+        <PackageReference Include="Shouldly" />
         <PackageReference Include="Microsoft.NET.Test.Sdk" />
         <PackageReference Include="xunit" />
         <PackageReference Include="xunit.runner.visualstudio" />
diff --git a/identity-server/test/IdentityServer.IntegrationTests/IdentityServer.IntegrationTests.csproj b/identity-server/test/IdentityServer.IntegrationTests/IdentityServer.IntegrationTests.csproj
index 25203da80..631bd50f1 100644
--- a/identity-server/test/IdentityServer.IntegrationTests/IdentityServer.IntegrationTests.csproj
+++ b/identity-server/test/IdentityServer.IntegrationTests/IdentityServer.IntegrationTests.csproj
@@ -18,6 +18,7 @@
         <PackageReference Include="xunit.runner.visualstudio" PrivateAssets="All" />
         <PackageReference Include="FluentAssertions" />
         <PackageReference Include="FluentAssertions.Web" />
+        <PackageReference Include="Shouldly" />
     </ItemGroup>
 
     <ItemGroup>
diff --git a/identity-server/test/IdentityServer.UnitTests/Endpoints/Results/ProtectedResourceErrorResultTests.cs b/identity-server/test/IdentityServer.UnitTests/Endpoints/Results/ProtectedResourceErrorResultTests.cs
new file mode 100644
index 000000000..d1c424f91
--- /dev/null
+++ b/identity-server/test/IdentityServer.UnitTests/Endpoints/Results/ProtectedResourceErrorResultTests.cs
@@ -0,0 +1,63 @@
+// Copyright (c) Duende Software. All rights reserved.
+// See LICENSE in the project root for license information.
+
+using Duende.IdentityServer.Endpoints.Results;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Net.Http.Headers;
+using Shouldly;
+using Xunit;
+
+namespace UnitTests.Endpoints.Results;
+
+public class ProtectedResourceErrorResultTests
+{
+    private readonly ProtectedResourceErrorHttpWriter writer = new();
+
+    [Fact]
+    public void WwwAuthenticate_header_with_error_and_description_should_be_a_single_line()
+    {
+        var context = new DefaultHttpContext();
+
+        writer.WriteHttpResponse(
+            new ProtectedResourceErrorResult("oops", "big oops"),
+            context
+        );
+
+        var wwwAuthHeader = context.Response.Headers[HeaderNames.WWWAuthenticate].ToString();
+        wwwAuthHeader.ShouldBe(
+            """
+            Bearer realm="IdentityServer",error="oops",error_description="big oops"
+            """);
+    }
+
+    [Fact]
+    public void WwwAuthenticate_header_with_error_should_be_a_single_line()
+    {
+        var context = new DefaultHttpContext();
+
+        writer.WriteHttpResponse(
+            new ProtectedResourceErrorResult("oops"),
+            context
+        );
+
+        var wwwAuthHeader = context.Response.Headers[HeaderNames.WWWAuthenticate].ToString();
+        wwwAuthHeader.ShouldBe(
+            """
+            Bearer realm="IdentityServer",error="oops"
+            """);
+    }
+
+    [Fact]
+    public void WwwAuthenticate_header_should_always_be_a_single_string_value()
+    {
+        var context = new DefaultHttpContext();
+
+        writer.WriteHttpResponse(
+            new ProtectedResourceErrorResult("oops", "big oops"),
+            context
+        );
+
+        var wwwAuthHeader = context.Response.Headers[HeaderNames.WWWAuthenticate];
+        wwwAuthHeader.Count.ShouldBe(1);
+    }
+}
diff --git a/identity-server/test/IdentityServer.UnitTests/IdentityServer.UnitTests.csproj b/identity-server/test/IdentityServer.UnitTests/IdentityServer.UnitTests.csproj
index 674ea4fce..3b8abc296 100644
--- a/identity-server/test/IdentityServer.UnitTests/IdentityServer.UnitTests.csproj
+++ b/identity-server/test/IdentityServer.UnitTests/IdentityServer.UnitTests.csproj
@@ -16,6 +16,7 @@
         <PackageReference Include="xunit" />
         <PackageReference Include="xunit.runner.visualstudio" PrivateAssets="All" />
         <PackageReference Include="FluentAssertions" />
+        <PackageReference Include="Shouldly" />
     </ItemGroup>
 
     <ItemGroup>