Digest authentication using Javascript XMLHttpRequest
digest-authentication, hash, javascript, xmlhttprequest
Solution
The mistake was specifying the `username` parameter with a colon, it should have been an equals sign (`username:"login"` vs `username="login"`):
Authorization: Digest username="login", realm="Guard", nonce="7d0c753c2fb4cdc9480403547952f1", uri="/", algorithm=MD5, response="e9d8ad8f04e42672f2c21d70257c1072", qop=auth, nc=00000001, cnonce="bd5fd9b093dccaa1"
Problem
I'm trying to authenticate with an API that uses Digest authentication. I am sending a POST request to the server but the response returned is `HTTP 401 Denied`. This is the `WWW-Authenticate` challenge header from the server: (backslashes included for formatting, not present in response header) ``` WWW-Authenticate: Digest realm="Guard", domain="/", \ nonce="MTMzOTA5Mjk1NTE2NDo0NzY2NjJiOTgyMjE1ZDc0OWU3NzM5MTkzMWNjNGQzNw==", \ algorithm=MD5, qop="auth" ``` Using parameters from this header I apply the digest authentication algorithm and build the challenge reply header: ``` const HA1 = MD5("login:Guard:mypassword"); const HA2 = MD5("POST:/"); const authHash = MD5( HA1 + ':' + unquotes(tokensObj["nonce"]) + ':' + tokensObj["nc"] + ':' + tokensObj["cnonce"] + ':' + unquotes(tokensObj["qop"]) + ':' + HA2 ); const challengeReply = 'Digest username:"login"' + ', realm=' + tokensObj["realm"] + ', nonce=' + tokensObj["nonce"] + ', uri=' + tokensObj["domain"] + ', algorithm=' + tokensObj["algorithm"] + ', response="' + authHash + '"' + ', qop=' + unquotes(tokensObj["qop"]) + ', nc=' + tokensObj["nc"] + ', cnonce="' + tokensObj["cnonce"] + '"'; xhr.setRequestHeader("Authorization", challengeReply); ``` The header sent to the server: ``` Authorization: Digest username:"login", realm="Guard", \ nonce="7d0c753c2fb4cdc9480403547952f1", uri="/", algorithm=MD5, \ response="e9d8ad8f04e42672f2c21d70257c1072", qop=auth, nc=00000001, \ cnonce="bd5fd9b093dccaa1" ``` But this doesn't work, I still receive HTTP 401 Denied. The server digest authentication has been tested.