{"id":"d37509dd59133fc5","repo":"aio-libs/aiohttp","slug":"malformed-digest-auth-challenge-missing-realm-p","errorCode":null,"errorMessage":"Malformed Digest auth challenge: Missing 'realm' parameter","messagePattern":"Malformed Digest auth challenge: Missing 'realm' parameter","errorType":"exception","errorClass":"ClientError","httpStatus":null,"severity":"error","filePath":"aiohttp/client_middleware_digest_auth.py","lineNumber":243,"sourceCode":"        \"\"\"\n        Build digest authorization header for the current challenge.\n\n        Args:\n            method: The HTTP method (GET, POST, etc.)\n            url: The request URL\n            body: The request body (used for qop=auth-int)\n\n        Returns:\n            A fully formatted Digest authorization header string\n\n        Raises:\n            ClientError: If the challenge is missing required parameters or\n                         contains unsupported values\n\n        \"\"\"\n        challenge = self._challenge\n        if \"realm\" not in challenge:\n            raise ClientError(\n                \"Malformed Digest auth challenge: Missing 'realm' parameter\"\n            )\n\n        if \"nonce\" not in challenge:\n            raise ClientError(\n                \"Malformed Digest auth challenge: Missing 'nonce' parameter\"\n            )\n\n        # Empty realm values are allowed per RFC 7616 (SHOULD, not MUST, contain host name)\n        realm = challenge[\"realm\"]\n        nonce = challenge[\"nonce\"]\n\n        # Empty nonce values are not allowed as they are security-critical for replay protection\n        if not nonce:\n            raise ClientError(\n                \"Security issue: Digest auth challenge contains empty 'nonce' value\"\n            )\n","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/client_middleware_digest_auth.py#L225-L261","documentation":"Raised as `ClientError` in `DigestAuthMiddleware._encode` (client_middleware_digest_auth.py:242-245) when the parsed Digest challenge dict lacks a `realm` key. `realm` is mandatory per RFC 7616 (and RFC 2617) and is required material for every digest hash (H(A1) includes `username:realm:password`). Without it the digest cannot be computed, so the middleware refuses rather than sending an unauthenticated or wrong response.","triggerScenarios":"Server returns `WWW-Authenticate: Digest` *without* a `realm=` parameter; the challenge is so malformed that the parser (parse_header_pairs) extracted no realm; server returned a different auth scheme whose challenge the middleware mistook for Digest.","commonSituations":"Server misconfiguration omitting realm; custom/legacy auth server not following RFC; the middleware applied to a route protected by Basic or Bearer auth instead of Digest; challenge was truncated by a proxy.","solutions":["Inspect the actual `WWW-Authenticate` header the server sent (capture response headers).","Fix the server to include `realm=` in its Digest challenge (RFC 7616 §3.6).","Confirm the route actually uses Digest auth; if it uses Basic/Bearer, use the appropriate auth mechanism instead.","Catch `ClientError` from the middleware and fall back to a non-digest request or report the misconfiguration."],"exampleFix":"// before\n# server sends: WWW-Authenticate: Digest nonce=\"abc\"\n# -> missing realm -> ClientError\n// after (server-side)\n# WWW-Authenticate: Digest realm=\"myrealm\", nonce=\"abc\", qop=\"auth\"","handlingStrategy":"try-catch","validationCode":"from aiohttp import hdrs\n\ndef challenge_has_realm(resp_headers) -> bool:\n    auth = resp_headers.get(hdrs.WWW_AUTHENTICATE, '')\n    return 'realm=' in auth.lower()","typeGuard":null,"tryCatchPattern":"from aiohttp import ClientError\n\ntry:\n    resp = await session.get(url, middlewares=[digest_mw])\nexcept ClientError as e:\n    if \"Missing 'realm'\" in str(e):\n        log.error('server Digest challenge lacks realm; check WWW-Authenticate')\n    raise","preventionTips":["Verify the server sends `WWW-Authenticate: Digest realm=..., nonce=..., ...`.","Only apply the Digest middleware to routes that actually use Digest auth.","Capture and log the WWW-Authenticate header on 401s to spot malformed challenges."],"tags":["client","digest-auth","authentication","server-misbehavior","rfc"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}