-
-
Notifications
You must be signed in to change notification settings - Fork 9.7k
Description
The HTTPDigestAuth.build_digest_header() method produces the Digest header witch contains quoted strings for algorithm and qop tokens. E.g.:
Digest username="admin", realm="server", nonce="QScBItGtnPq4Dz3v25Tht4SlctJnsR", uri="/api/v1/info", response="e0d12a4b85789351a847c773e6f4b30e", algorithm="MD5", qop="auth", nc=00000001, cnonce="0f905170a2cafe15"
While according to RFC 7616 these tokens must not be quoted:
Digest username="admin", realm="server", nonce="QScBItGtnPq4Dz3v25Tht4SlctJnsR", uri="/api/v1/info", response="e0d12a4b85789351a847c773e6f4b30e", algorithm=MD5, qop=auth, nc=00000001, cnonce="0f905170a2cafe15"
Below is the corresponding part of the RFC:
For historical reasons, a sender MUST only generate the quoted string syntax for the following parameters: username, realm, nonce, uri, response, cnonce, and opaque.
For historical reasons, a sender MUST NOT generate the quoted string syntax for the following parameters: algorithm, qop, and nc.
This can also be seen in requests examples in the RFC.
Current behavior may cause problems with some servers. The following subclass can be used as a temporary workaround:
class FixedHTTPDigestAuth(HTTPDigestAuth):
def build_digest_header(self, method, url):
header = super().build_digest_header(method, url)
invalid_parts = ('algorithm', 'qop')
parts = header.split(', ')
for i, part in enumerate(parts):
if any(part.startswith(ip + '=') for ip in invalid_parts):
parts[i] = part.replace('"', '')
header = ', '.join(parts)
return header