* 構文

[3] >>1 によると[[空文字列]]も特に制限されていないみたいですね。

* RFC 2617 から

[1]
>
[PRE(ABNF code)[
      realm       = "realm" "=" realm-value
      realm-value = quoted-string
]PRE]
>   The realm directive (case-insensitive) is required for all
authentication schemes that issue a challenge. The realm value
(case-sensitive), in combination with the canonical root URL (the
absoluteURI for the server whose abs_path is empty; see section 5.1.2
of [2]) of the server being accessed, defines the protection space.
These realms allow the protected resources on a server to be
partitioned into a set of protection spaces, each with its own
authentication scheme and/or authorization database. The realm value
is a string, generally assigned by the origin server, which may have
additional semantics specific to the authentication scheme. Note that
there may be multiple challenges with the same auth-scheme but
different realms.