{"action":"created","issue":{"url":"https://api.github.com/repos/kennethreitz/requests/issues/2408","labels_url":"https://api.github.com/repos/kennethreitz/requests/issues/2408/labels{/name}","comments_url":"https://api.github.com/repos/kennethreitz/requests/issues/2408/comments","events_url":"https://api.github.com/repos/kennethreitz/requests/issues/2408/events","html_url":"https://github.com/kennethreitz/requests/issues/2408","id":54311142,"number":2408,"title":"Wrong digest header creation when server has qop=\"auth,auth-int\"","user":{"login":"berndschultze","id":10529974,"avatar_url":"https://avatars.githubusercontent.com/u/10529974?v=3","gravatar_id":"","url":"https://api.github.com/users/berndschultze","html_url":"https://github.com/berndschultze","followers_url":"https://api.github.com/users/berndschultze/followers","following_url":"https://api.github.com/users/berndschultze/following{/other_user}","gists_url":"https://api.github.com/users/berndschultze/gists{/gist_id}","starred_url":"https://api.github.com/users/berndschultze/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/berndschultze/subscriptions","organizations_url":"https://api.github.com/users/berndschultze/orgs","repos_url":"https://api.github.com/users/berndschultze/repos","events_url":"https://api.github.com/users/berndschultze/events{/privacy}","received_events_url":"https://api.github.com/users/berndschultze/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-01-14T11:21:32Z","updated_at":"2015-01-14T17:16:00Z","closed_at":null,"body":"I always get \"401 unauthorized\" when trying to log in to a server which writes qop=\"auth,auth-int\" in its answer. The problem doesn't exist with Curl.\r\nI debugged the requests code and probably found the problem in auth.py. The function build_digest_header in class HTTPDigestAuth calculates\r\n    noncebit = \"%s:%s:%s:%s:%s\" % (nonce, ncvalue, cnonce, qop, HA2)\r\nand gives back\r\n    base += ', qop=\"auth\", nc=%s, cnonce=\"%s\"' % (ncvalue, cnonce)\r\nto the server.\r\n\r\nSo in our client digest calculation we use qop=\"auth,auth-int\", which we take from the server response, and make the server use qop=\"auth\" in its calculation by giving back this header.\r\n\r\nWhile debugging I can log in correctly if I change noncebit on the fly to\r\n    noncebit = \"%s:%s:%s:%s:%s\" % (nonce, ncvalue, cnonce, \"auth\", HA2)\r\nThis would be my suggestion for the solution. Theqop for the calculation should be the same as we give back in our header."},"comment":{"url":"https://api.github.com/repos/kennethreitz/requests/issues/comments/69952739","html_url":"https://github.com/kennethreitz/requests/issues/2408#issuecomment-69952739","issue_url":"https://api.github.com/repos/kennethreitz/requests/issues/2408","id":69952739,"user":{"login":"berndschultze","id":10529974,"avatar_url":"https://avatars.githubusercontent.com/u/10529974?v=3","gravatar_id":"","url":"https://api.github.com/users/berndschultze","html_url":"https://github.com/berndschultze","followers_url":"https://api.github.com/users/berndschultze/followers","following_url":"https://api.github.com/users/berndschultze/following{/other_user}","gists_url":"https://api.github.com/users/berndschultze/gists{/gist_id}","starred_url":"https://api.github.com/users/berndschultze/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/berndschultze/subscriptions","organizations_url":"https://api.github.com/users/berndschultze/orgs","repos_url":"https://api.github.com/users/berndschultze/repos","events_url":"https://api.github.com/users/berndschultze/events{/privacy}","received_events_url":"https://api.github.com/users/berndschultze/received_events","type":"User","site_admin":false},"created_at":"2015-01-14T17:16:00Z","updated_at":"2015-01-14T17:16:00Z","body":"@Lukasa You are right, I misunderstood. Thanks again."}}