{"id":"41e5f47b1f3e4b13","repo":"encode/httpx","slug":"digest-auth-int-support-is-not-yet-implemented","errorCode":null,"errorMessage":"Digest auth-int support is not yet implemented","messagePattern":"Digest auth-int support is not yet implemented","errorType":"exception","errorClass":"NotImplementedError","httpStatus":null,"severity":"error","filePath":"httpx/_auth.py","lineNumber":337,"sourceCode":"                header_value += \", \"\n            template = (\n                QUOTED_TEMPLATE\n                if field not in NON_QUOTED_FIELDS\n                else NON_QUOTED_TEMPLATE\n            )\n            header_value += template.format(field, to_str(value))\n\n        return header_value\n\n    def _resolve_qop(self, qop: bytes | None, request: Request) -> bytes | None:\n        if qop is None:\n            return None\n        qops = re.split(b\", ?\", qop)\n        if b\"auth\" in qops:\n            return b\"auth\"\n\n        if qops == [b\"auth-int\"]:\n            raise NotImplementedError(\"Digest auth-int support is not yet implemented\")\n\n        message = f'Unexpected qop value \"{qop!r}\" in digest auth'\n        raise ProtocolError(message, request=request)\n\n\nclass _DigestAuthChallenge(typing.NamedTuple):\n    realm: bytes\n    nonce: bytes\n    algorithm: str\n    opaque: bytes | None\n    qop: bytes | None\n","sourceCodeStart":319,"sourceCodeEnd":349,"githubUrl":"https://github.com/encode/httpx/blob/b5addb64f0161ff6bfe94c124ef76f6a1fba5254/httpx/_auth.py#L319-L349","documentation":"Raised as NotImplementedError by DigestAuth._resolve_qop when the server's qop list contains only 'auth-int'. httpx implements qop=auth but not qop=auth-int (which requires hashing the request body for integrity), so a server that offers exclusively integrity protection cannot be negotiated.","triggerScenarios":"Using httpx.DigestAuth against a server whose 401 challenge declares qop=\"auth-int\" with no \"auth\" alternative (e.g. 'Digest ... qop=\"auth-int\"'). _resolve_qop splits qop and only proceeds if 'auth' is present.","commonSituations":"Strict enterprise gateways or SIP-style services that mandate body integrity protection; security-hardened servers that disable qop=auth.","solutions":["Reconfigure the server to also offer qop=auth alongside auth-int.","Switch away from httpx.DigestAuth to a bearer-token or BasicAuth scheme if the endpoint allows it.","Fall back to a different HTTP library that implements auth-int, or vendor a patched _resolve_qop."],"exampleFix":"// before\nclient.get(url, auth=httpx.DigestAuth(\"u\", \"p\"))\n// after\n# server config: change qop=\"auth-int\" to qop=\"auth,auth-int\"\nclient.get(url, auth=httpx.DigestAuth(\"u\", \"p\"))","handlingStrategy":"try-catch","validationCode":"import re\nprobe = client.get(url)\nwa = probe.headers.get_list(\"www-authenticate\") if probe.status_code == 401 else []\nfor h in wa:\n    if h.lower().startswith(\"digest \"):\n        m = re.search(r'qop=\"?([^\"]+)\"?', h)\n        if m:\n            qops = [q.strip() for q in m.group(1).split(\",\")]\n            only_auth_int = \"auth\" not in qops and qops == [\"auth-int\"]\n            # if only_auth_int, DigestAuth will raise NotImplementedError","typeGuard":"def digest_supports_auth(www_auth_values: list[str]) -> bool:\n    import re\n    for h in www_auth_values:\n        if h.lower().startswith(\"digest \"):\n            m = re.search(r'qop=\"?([^\"]+)\"?', h)\n            if m and \"auth\" in [q.strip() for q in m.group(1).split(\",\")]:\n                return True\n    return False","tryCatchPattern":"try:\n    resp = client.get(url, auth=httpx.DigestAuth(user, pw))\nexcept NotImplementedError:\n    # Server requires auth-int which httpx does not implement\n    resp = client.get(url, headers={\"Authorization\": \"Bearer <token>\"})","preventionTips":["Check whether the server advertises qop=auth before using DigestAuth.","For servers mandating auth-int, use a token/custom auth scheme instead.","Wrap DigestAuth calls so NotImplementedError is handled gracefully."],"tags":["digest-auth","authentication","unsupported"],"analyzedSha":"b5addb64f0161ff6bfe94c124ef76f6a1fba5254","analyzedAt":"2026-08-04T19:32:56.768Z","schemaVersion":2}