hoppscotch/hoppscotch · error · Error

Failed to parse authentication parameters from WWW-Authentic

Error message

Failed to parse authentication parameters from WWW-Authenticate header

What it means

Common-package (frontend/web) analog of [51]. fetchInitialDigestAuthInfo throws when the kernel-interceptor response is 401 but the WWW-Authenticate header is missing or not parseable into realm/nonce/qop. Uses the same parseDigestAuthHeader regex contract as the CLI; runs in the browser/desktop via KernelInterceptorService.

Source

Thrown at packages/hoppscotch-common/src/helpers/auth/digest.ts:135

      if (authHeader) {
        const authParams = parseDigestAuthHeader(authHeader)
        if (
          authParams &&
          authParams.realm &&
          authParams.nonce &&
          authParams.qop
        ) {
          return {
            realm: authParams.realm,
            nonce: authParams.nonce,
            qop: authParams.qop,
            opaque: authParams.opaque,
            algorithm: authParams.algorithm,
          }
        }
      }

      throw new Error(
        "Failed to parse authentication parameters from WWW-Authenticate header"
      )
    }

    throw new Error(`Unexpected response: ${initialResponse.right.status}`)
  } catch (error) {
    const errMsg = error instanceof Error ? error.message : error

    console.error(`Failed to fetch initial Digest Auth info: ${errMsg}`)

    throw error // Re-throw the error to handle it further up the chain if needed
  }
}

// Utility function to parse Digest auth header values
function parseDigestAuthHeader(
  header: string
): { [key: string]: string } | null {

View on GitHub (pinned to 1acb8a3a75)

Solutions

1. Verify the server returns a Digest WWW-Authenticate on 401 (check via a non-browser client).
2. If running in the browser, ensure the server sends Access-Control-Expose-Headers: WWW-Authenticate.
3. Switch to the auth scheme the server actually uses.
4. If the header is non-standard, extend parseDigestAuthHeader to accept the format.

// Before invoking Digest, ensure the browser can even see WWW-Authenticate.
// Server must include: Access-Control-Expose-Headers: WWW-Authenticate
if (!canSeeAuthHeader(responseHeaders)) {
  warn('WWW-Authenticate not exposed via CORS');
}

function hasDigestParams(p: Record<string,string>|null): p is { realm:string; nonce:string; qop:string } {
  return !!p && !!p.realm && !!p.nonce && !!p.qop;
}

try {
  await fetchInitialDigestAuthInfo(url, method);
} catch (e) {
  if (e instanceof Error && /WWW-Authenticate/.test(e.message)) {
    // suggest switching auth scheme or fixing CORS exposure
  } else throw e;
}

When it happens

Trigger: A Hoppscotch app (web/desktop) request configured with Digest auth where the 401 response lacks a parseable WWW-Authenticate header. Surfaces in the response panel as the thrown error message.

Common situations: Wrong auth scheme selected for the endpoint; server returns a non-Digest challenge; interceptor strips/renames the header; CORS hides WWW-Authenticate from the browser (browser only exposes CORS-safelisted response headers unless exposed).

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Unexpected response: ${initialResponse.right.status}
• Received status: ${initialResponse.status}. Retry is disable
• Failed to parse authentication parameters from WWW-Authentic
• Unexpected response: ${initialResponse.status}
• auth/cookies_not_found

AI-assisted analysis of hoppscotch/hoppscotch@1acb8a3a75 (2026-08-12). Data as JSON: /api/errors/2228cdb86d76aafc. Report an issue: GitHub.