aio-libs/aiohttp · error · ClientError

Digest auth error: Unsupported hash algorithm: {algorithm}.

Error message

Digest auth error: Unsupported hash algorithm: {algorithm}. Supported algorithms: {supported}

What it means

Raised as a ClientError when the 'algorithm' field of a Digest challenge names a hash aiohttp does not implement. The supported set is defined in DigestFunctions/SUPPORTED_ALGORITHMS (typically MD5, MD5-SESS, SHA-256, SHA-256-SESS). The original case is preserved for the response, but matching is case-insensitive.

Source

Thrown at aiohttp/client_middleware_digest_auth.py:293

        path = URL(url).raw_path_qs

        # Process QoP
        qop = ""
        qop_bytes = b""
        if qop_raw:
            valid_qops = {"auth", "auth-int"}.intersection(
                {q.strip() for q in qop_raw.split(",") if q.strip()}
            )
            if not valid_qops:
                raise ClientError(
                    f"Digest auth error: Unsupported Quality of Protection (qop) value(s): {qop_raw}"
                )

            qop = "auth-int" if "auth-int" in valid_qops else "auth"
            qop_bytes = qop.encode("utf-8")

        if algorithm not in DigestFunctions:
            raise ClientError(
                f"Digest auth error: Unsupported hash algorithm: {algorithm}. "
                f"Supported algorithms: {', '.join(SUPPORTED_ALGORITHMS)}"
            )
        hash_fn: Final = DigestFunctions[algorithm]

        def H(x: bytes) -> bytes:
            """RFC 7616 Section 3: Hash function H(data) = hex(hash(data))."""
            return hash_fn(x).hexdigest().encode()

        def KD(s: bytes, d: bytes) -> bytes:
            """RFC 7616 Section 3: KD(secret, data) = H(concat(secret, ":", data))."""
            return H(b":".join((s, d)))

        # Calculate A1 and A2
        A1 = b":".join((self._login_bytes, realm_bytes, self._password_bytes))
        A2 = f"{method.upper()}:{path}".encode()
        if qop == "auth-int":
            if isinstance(body, Payload):  # will always be empty bytes unless Payload

View on GitHub (pinned to c0ef574e29)

Solutions

1. Reconfigure the server to use SHA-256 (the recommended secure algorithm aiohttp supports).
2. Upgrade aiohttp to a newer version that may have added the algorithm.
3. If SHA-512 is mandatory, use a client library that implements it or contribute the hash function to DigestFunctions.

Example fix

# before: server sends algorithm=SHA-512
# after (Apache htdigest / nginx): configure algorithm=SHA-256

from aiohttp import ClientError
try:
    resp = await session.get(url, auth=DigestAuth(login, pwd))
except ClientError as e:
    if "Unsupported hash algorithm" in str(e):
        # server uses an algorithm aiohttp can't compute; switch auth or client

When it happens

Trigger: Fires at line 292-296 when `algorithm.upper()` is not a key in DigestFunctions. Triggered by challenges advertising algorithms like SHA-512, SHA3-256, or proprietary names.

Common situations: Server hardened to SHA-512 only; experimental auth modules; mismatch between server-side digest algorithm availability and what aiohttp supports in your installed version.

Related errors

• Digest auth error: Unsupported Quality of Protection (qop) v
• Security issue: Digest auth challenge contains empty 'nonce'
• Connection timeout to host {url}
• base_url must have a trailing '/'
• ssl should be SSLContext, Fingerprint, or bool, got {ssl!r}

AI-assisted analysis of aio-libs/aiohttp@c0ef574e29 (2026-08-04). Data as JSON: /data/errors/6f754c1ab52326fd.json. Report an issue: GitHub.