Skip to content

HTTPDigestAuth uses quotes for algorithm and qop tokens of the Digest header #5745

@alex-che

Description

@alex-che

The HTTPDigestAuth.build_digest_header() method produces the Digest header witch contains quoted strings for algorithm and qop tokens. E.g.:
Digest username="admin", realm="server", nonce="QScBItGtnPq4Dz3v25Tht4SlctJnsR", uri="/api/v1/info", response="e0d12a4b85789351a847c773e6f4b30e", algorithm="MD5", qop="auth", nc=00000001, cnonce="0f905170a2cafe15"

While according to RFC 7616 these tokens must not be quoted:
Digest username="admin", realm="server", nonce="QScBItGtnPq4Dz3v25Tht4SlctJnsR", uri="/api/v1/info", response="e0d12a4b85789351a847c773e6f4b30e", algorithm=MD5, qop=auth, nc=00000001, cnonce="0f905170a2cafe15"

Below is the corresponding part of the RFC:

For historical reasons, a sender MUST only generate the quoted string syntax for the following parameters: username, realm, nonce, uri, response, cnonce, and opaque.

For historical reasons, a sender MUST NOT generate the quoted string syntax for the following parameters: algorithm, qop, and nc.

This can also be seen in requests examples in the RFC.

Current behavior may cause problems with some servers. The following subclass can be used as a temporary workaround:

class FixedHTTPDigestAuth(HTTPDigestAuth):
    def build_digest_header(self, method, url):
        header = super().build_digest_header(method, url)
        invalid_parts = ('algorithm', 'qop')
        parts = header.split(', ')
        for i, part in enumerate(parts):
            if any(part.startswith(ip + '=') for ip in invalid_parts):
                parts[i] = part.replace('"', '')
        header = ', '.join(parts)
        return header

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions