'qop' paramter must not be enclosed between doble quotation (") about httpclient HOT 4 CLOSED

The same applies for 'algorithm' which should not be enclosed between ".
I've updated the patch: http://gist.github.com/259724

from httpclient.

Applied a patch from ibc: DigestAuth header quotation error: closed by 6f48800.

qup and algorithm is not required to be quoted. RFC2617 includes an
example 'qop="auth,auth-int"' though...

from httpclient.

The example in RFC 2617 'qop="auth,auth-int"' is in a response so in WWW-Authenticate or Proxy-Authenticate headers. In this case the "qop" grammar does require value enclosed between double quotes.

But in WWW-Authorization or Proxy-Authorization headers (this is, in HTTP requests) qop grammar is different, it can contain just one value so doesn't allow double quotes.

RFC 2617 section 3.2.1 The WWW-Authenticate Response Header:

qop-options       = "qop" "=" <"> 1#qop-value <">
qop-value         = "auth" | "auth-int" | token

RFC 2617 3.2.2 The Authorization Request Header:

message-qop      = "qop" "=" qop-value

from httpclient.

You're right. Thank you!

ibc, since you know DigestAuth spec better than me, would you please check the fix for https://github.com/nahi/httpclient/issues/closed#issue/43, too if you can? Does the change look safe?

from httpclient.