Remove http_digest

[ericproulx]

Summary

Nothing http_digest could reach has existed since 2.0.0. #2361 removed Rack::Auth::Digest and Grape's :http_digest strategy after Rack 3 dropped digest authentication — but Grape::Middleware::Auth::DSL#http_digest survived, complete with its opaque-defaulting logic, and kept recording its settings happily.

So an API declaring it still booted, and then raised on the first request:

class API < Grape::API
  http_digest(realm: 'r') { |u| lookup_password(u) }   # class loads fine
  get('/x') { 'ok' }
end

Grape::Exceptions::UnknownAuthStrategy: unknown auth strategy: http_digest
  lib/grape/middleware/auth/base.rb:12:in 'initialize'
  rack/builder.rb:164:in 'block in use'

Raised from inside the middleware build, so it escaped as an uncaught exception rather than a response — a misconfiguration only visible in production.

The 4.0 UPGRADING notes pointed at it too, using auth :http_digest, realm: 'API', opaque: 'secret', &proc as a worked example of a supported call.

	before	after
http_digest(...) with no registered strategy	boots, then raises on every request	NoMethodError while the class is defined
auth :http_digest, ... with a registered strategy	works	works, unchanged

Why remove the sugar rather than validate the strategy

I tried validating in #auth so an unregistered strategy raises at definition time. It breaks 6 in-tree specs: dsl_spec.rb has a .http_digest block asserting it "sets auth parameters", and the .auth specs use :http_digest as their example label throughout.

That makes the contract deliberate and specified — #auth records whatever label it is given and resolves the strategy when the middleware is built, which is exactly what lets an application register its own. Validating early breaks that, and would also break registering a strategy after the API class is defined.

So only the sugar goes. auth :http_digest still works for anyone who registered a strategy under that label; verified.

Backward compatibility

UPGRADING entry added, and the existing keyword-arguments section rewritten to stop advertising http_digest.

The removed method supplied two defaults auth does not — realm defaulted to 'API Authorization' and opaque to 'secret' (nested inside realm when realm was itself a Hash) — so UPGRADING spells those out for anyone migrating a custom strategy to auth.

Test plan

• The .http_digest describe block and its deprecation example are removed; the .auth specs now use a neutral :custom label, which keeps the distinction they are actually about (a label is recorded, the strategy is looked up later).
• Verified http_digest now raises NoMethodError at definition, and that auth :http_digest with a registered strategy still authenticates (200).
• Full RSpec suite passes locally (2540 examples, 0 failures — three fewer than before, being the removed examples).
• RuboCop clean.
• CI green.

🤖 Generated with Claude Code

[github-actions]

Danger Report

No issues found.

View run