diff options
| -rw-r--r-- | Lib/urllib/request.py | 6 | ||||
| -rw-r--r-- | Misc/NEWS.d/next/Library/2019-11-06-15-26-15.bpo-38686.HNFBce.rst | 1 |
2 files changed, 5 insertions, 2 deletions
diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py index 37b2548628..1ec484ed24 100644 --- a/Lib/urllib/request.py +++ b/Lib/urllib/request.py @@ -1143,7 +1143,9 @@ class AbstractDigestAuthHandler: A2 = "%s:%s" % (req.get_method(), # XXX selector: what about proxies and full urls req.selector) - if qop == 'auth': + # NOTE: As per RFC 2617, when server sends "auth,auth-int", the client could use either `auth` + # or `auth-int` to the response back. we use `auth` to send the response back. + if 'auth' in qop.split(','): if nonce == self.last_nonce: self.nonce_count += 1 else: @@ -1151,7 +1153,7 @@ class AbstractDigestAuthHandler: self.last_nonce = nonce ncvalue = '%08x' % self.nonce_count cnonce = self.get_cnonce(nonce) - noncebit = "%s:%s:%s:%s:%s" % (nonce, ncvalue, cnonce, qop, H(A2)) + noncebit = "%s:%s:%s:%s:%s" % (nonce, ncvalue, cnonce, 'auth', H(A2)) respdig = KD(H(A1), noncebit) elif qop is None: respdig = KD(H(A1), "%s:%s" % (nonce, H(A2))) diff --git a/Misc/NEWS.d/next/Library/2019-11-06-15-26-15.bpo-38686.HNFBce.rst b/Misc/NEWS.d/next/Library/2019-11-06-15-26-15.bpo-38686.HNFBce.rst new file mode 100644 index 0000000000..7a419ff1e3 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2019-11-06-15-26-15.bpo-38686.HNFBce.rst @@ -0,0 +1 @@ +Added support for multiple ``qop`` values in :class:`urllib.request.AbstractDigestAuthHandler`.
\ No newline at end of file |