DigestAuthentication not working

[robin-blanchard]

Hello,
It seems to be an issue with DigestAuthentication. Even with a basic HTTP server, I can't manage to correctly authenticate a client with httpx.

Here's the server implementation with Flask:

from flask import Flask
from flask_httpauth import HTTPDigestAuth

app = Flask(__name__)
app.config['SECRET_KEY'] = 'secret key here'
auth = HTTPDigestAuth()

users = {
    "john": "hello",
    "susan": "bye"
}


@auth.get_password
def get_pw(username):
    if username in users:
        return users.get(username)
    return None


@app.route('/', methods=['GET', 'POST'])
@auth.login_required
def index():
    return "Hello, {}!".format(auth.username())


if __name__ == '__main__':
    app.run(host="0.0.0.0", debug=True)

And here's the small client:

import httpx

auth = httpx.DigestAuth("susan", "bye")
print(httpx.get("http://192.168.2.140:5000/", auth=auth).status_code)

This code returns 401.

httpx version: 0.24.1

Does anyone has a solution ? I plan on using httpx to send asynchronous requests to a server with Digest Authentication. Only httpx seems to provide Digest Authentication with async support.

Many thanks

[robin-blanchard]

When debugging, it looks like:

• As expected, the first request receives a 401 response
• As expected, httpx tries to handle the challenge
• But the re-request also receives a 401 response

It seems like the challenge isn't properly handled

[karpetrosyan]

It works with the requests library, so I believe this is the problem. Do you want to open a ticket?

[robin-blanchard]

Yes I forgot to add this information, thanks !
Sure, if you also think there is an issue

[robin-blanchard]

After a bit of debugging, I'm not actually sure the issue comes from httpx.
When using httpx, at this line https://github.com/miguelgrinberg/Flask-HTTPAuth/blob/main/src/flask_httpauth.py#L296, session_nonce is None. Hence, the whole verification isn't even done.
With requests, the session isn't re-initialized and everything works.

Is there any reason httpx would lead to the session being re-initialized ?