AuthenticationProtocolHandler unable to parse Digest WWW Header

[TheJoeIaut]

Hey,

I am having massive problems trying to authenticate against a digest auth endpoint.

For testing purposes i use http://httpbin.org/digest-auth/auth/user/passwd/MD5

That returns a WWW Header of:
Digest algorithm=MD5, qop="auth", opaque="c0c3e9b6dfa9fcbcefe9a64e8a5d1c0e", nonce="e3bcda70806caad3ebdf4e8078cbcf6b", realm="me@kennethreitz.com"

But this results in the exception:

org.eclipse.jetty.client.HttpResponseException: HTTP protocol violation: Authentication challenge without WWW-Authenticate header

The problem IMO is, that the regex parsing the WWW header in AuthenticationProtocolHandler won't match that header.

What can i do and are there any known workarounds?

For completness here is my code:

    HttpClient httpClient = new HttpClient();

 	httpClient.start();

	String realm = "me@kennethreitz.com";
	String user = "user";
	String pass = "passwd";
	URI uri =new URI("http://httpbin.org/digest-auth/auth/user/passwd/MD5");
	AuthenticationStore a = httpClient.getAuthenticationStore();
	a.addAuthentication(
	    new DigestAuthentication(uri, realm, user, pass));


	
	ContentResponse response = httpClient
	        .newRequest(uri)
	        .send();
	        //.get(5, TimeUnit.SECONDS);
	
	System.out.println(response);

[joakime]

What version of Jetty Client?

[TheJoeIaut]

9.4.5.v20170502

[sbordet]

We assume that the server replies with the realm as first auth-param, but RFC 7235 does not specify any order, and does not even require it to be present (https://tools.ietf.org/html/rfc7235#appendix-A).

[TheJoeIaut]

I don't think thats the only problem:

Tested it also with the correct order: https://regex101.com/r/71olOo/1

[sbordet]

Once you remove the double backslashes, works for me.

[digitaldan]

Any update on this? I am also running into the issue where "realm" is not the first parameter in the authentication response. Is there a workaround?

[sbordet]

Writing a parser for the Authentication header is quite complicated as the syntax is just plain horrible.
We'll try to raise the priority of this.

[sbordet]

See also #1730.

[sbordet]

We merged #2426 to solve the realm position issue, and we are working on a better parser in #1555.

[gregw]

Better parser is in #2449. As that is essentially a better fix for this issue, let's leave this open until that is merged.