AlexxIT/go2rtc · error

unsupported qop

Error message

unsupported qop: ${auth}

What it means

tcp.Do Digest qop guard: the server's Digest challenge specifies a qop value that is neither empty nor 'auth' (e.g. 'auth-int'). The client only implements RFC 2617 qop='' and qop='auth', so it cannot construct a valid response header and the request fails.

Solutions

1. Reconfigure the device/auth server to use qop=auth or no qop
2. Patch the client to implement auth-int if the server cannot change
3. Route through an auth proxy that downgrades the challenge

When it happens

Trigger: Thrown at pkg/tcp/request.go:123 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/2f549de173359b12. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tcp/request.go:123

		var header string

		switch qop {
		case "":
			response := HexMD5(ha1, nonce, ha2)
			header = fmt.Sprintf(
				`Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"`,
				username, realm, nonce, uri, response,
			)
		case "auth":
			nc := "00000001"
			cnonce := core.RandString(32, 64)
			response := HexMD5(ha1, nonce, nc, cnonce, qop, ha2)
			header = fmt.Sprintf(
				`Digest username="%s", realm="%s", nonce="%s", uri="%s", qop=%s, nc=%s, cnonce="%s", response="%s"`,
				username, realm, nonce, uri, qop, nc, cnonce, response,
			)
		default:
			return nil, errors.New("unsupported qop: " + auth)
		}

		req.Header.Set("Authorization", header)

		if res, err = client.Do(req); err != nil {
			return nil, err
		}
	}

	return res, nil
}

var client *http.Client

type key string

var connKey = key("conn")
var secureKey = key("secure")

View on GitHub (pinned to c245815e75)