{"record":{"id":"2228cdb86d76aafc","repo":"hoppscotch/hoppscotch","slug":"failed-to-parse-authentication-parameters-from-www-2228cd","errorCode":null,"errorMessage":"Failed to parse authentication parameters from WWW-Authenticate header","messagePattern":"Failed to parse authentication parameters from WWW-Authenticate header","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/hoppscotch-common/src/helpers/auth/digest.ts","lineNumber":135,"sourceCode":"      if (authHeader) {\n        const authParams = parseDigestAuthHeader(authHeader)\n        if (\n          authParams &&\n          authParams.realm &&\n          authParams.nonce &&\n          authParams.qop\n        ) {\n          return {\n            realm: authParams.realm,\n            nonce: authParams.nonce,\n            qop: authParams.qop,\n            opaque: authParams.opaque,\n            algorithm: authParams.algorithm,\n          }\n        }\n      }\n\n      throw new Error(\n        \"Failed to parse authentication parameters from WWW-Authenticate header\"\n      )\n    }\n\n    throw new Error(`Unexpected response: ${initialResponse.right.status}`)\n  } catch (error) {\n    const errMsg = error instanceof Error ? error.message : error\n\n    console.error(`Failed to fetch initial Digest Auth info: ${errMsg}`)\n\n    throw error // Re-throw the error to handle it further up the chain if needed\n  }\n}\n\n// Utility function to parse Digest auth header values\nfunction parseDigestAuthHeader(\n  header: string\n): { [key: string]: string } | null {","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/hoppscotch/hoppscotch/blob/1acb8a3a7581e4db32ba0d529170c4669a2e1053/packages/hoppscotch-common/src/helpers/auth/digest.ts#L117-L153","documentation":"Common-package (frontend/web) analog of [51]. fetchInitialDigestAuthInfo throws when the kernel-interceptor response is 401 but the WWW-Authenticate header is missing or not parseable into realm/nonce/qop. Uses the same parseDigestAuthHeader regex contract as the CLI; runs in the browser/desktop via KernelInterceptorService.","triggerScenarios":"A Hoppscotch app (web/desktop) request configured with Digest auth where the 401 response lacks a parseable WWW-Authenticate header. Surfaces in the response panel as the thrown error message.","commonSituations":"Wrong auth scheme selected for the endpoint; server returns a non-Digest challenge; interceptor strips/renames the header; CORS hides WWW-Authenticate from the browser (browser only exposes CORS-safelisted response headers unless exposed).","solutions":["Verify the server returns a Digest WWW-Authenticate on 401 (check via a non-browser client).","If running in the browser, ensure the server sends Access-Control-Expose-Headers: WWW-Authenticate.","Switch to the auth scheme the server actually uses.","If the header is non-standard, extend parseDigestAuthHeader to accept the format."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before invoking Digest, ensure the browser can even see WWW-Authenticate.\n// Server must include: Access-Control-Expose-Headers: WWW-Authenticate\nif (!canSeeAuthHeader(responseHeaders)) {\n  warn('WWW-Authenticate not exposed via CORS');\n}","typeGuard":"function hasDigestParams(p: Record<string,string>|null): p is { realm:string; nonce:string; qop:string } {\n  return !!p && !!p.realm && !!p.nonce && !!p.qop;\n}","tryCatchPattern":"try {\n  await fetchInitialDigestAuthInfo(url, method);\n} catch (e) {\n  if (e instanceof Error && /WWW-Authenticate/.test(e.message)) {\n    // suggest switching auth scheme or fixing CORS exposure\n  } else throw e;\n}","preventionTips":["For browser Digest, always configure Access-Control-Expose-Headers: WWW-Authenticate on the server.","Confirm the scheme matches the server before enabling Digest in the request.","Make parseDigestAuthHeader tolerant of RFC variants where feasible."],"tags":["frontend","auth","digest-auth","cors","http"],"backgroundTag":null,"analyzedSha":"1acb8a3a7581e4db32ba0d529170c4669a2e1053","analyzedAt":"2026-08-12T11:34:52.648Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}