hoppscotch/hoppscotch · error · Error

Failed to parse authentication parameters from WWW-Authentic

Error message

Failed to parse authentication parameters from WWW-Authenticate header

What it means

Thrown by the CLI fetchInitialDigestAuthInfo when the server returned 401 but the WWW-Authenticate header was missing, absent, or could not be parsed into realm/nonce/qop. parseDigestAuthHeader regex /([a-z0-9]+)="([^"]+)"/gi requires quoted key=value pairs; if any of realm, nonce, or qop is missing the function refuses to proceed.

Source

Thrown at packages/hoppscotch-cli/src/utils/auth/digest.ts:142

      if (authHeader) {
        const authParams = parseDigestAuthHeader(authHeader);
        if (
          authParams &&
          authParams.realm &&
          authParams.nonce &&
          authParams.qop
        ) {
          return {
            realm: authParams.realm,
            nonce: authParams.nonce,
            qop: authParams.qop,
            opaque: authParams.opaque,
            algorithm: authParams.algorithm,
          };
        }
      }
      throw new Error(
        "Failed to parse authentication parameters from WWW-Authenticate header"
      );
    }

    throw new Error(`Unexpected response: ${initialResponse.status}`);
  } catch (error) {
    const errMsg = error instanceof Error ? error.message : error;

    console.error(
      exceptionColors.FAIL(
        `\n Error fetching initial digest auth info: ${errMsg} \n`
      )
    );
    throw error; // Re-throw the error to handle it further up the chain if needed
  }
};

View on GitHub (pinned to 1acb8a3a75)

Solutions

1. Confirm the server actually speaks Digest auth (check the raw 401 response headers).
2. Switch to the auth scheme the server advertises (Basic, Bearer, API key).
3. If the header is present but non-standard, the parser regex may need extending to unquoted values.
4. Capture the raw response to verify WWW-Authenticate exists and contains realm/nonce/qop.

// Pre-check: probe the endpoint once to confirm it advertises Digest.
const probe = await axios.request({ url, method, validateStatus: () => true });
const wwwAuth = Object.keys(probe.headers).find(h => h.toLowerCase() === 'www-authenticate');
if (!wwwAuth || !/digest/i.test(probe.headers[wwwAuth] as string)) {
  throw new Error('Endpoint does not advertise Digest auth');
}

function hasDigestParams(p: Record<string,string>|null): p is { realm:string; nonce:string; qop:string } {
  return !!p && !!p.realm && !!p.nonce && !!p.qop;
}

try {
  await fetchInitialDigestAuthInfo(url, method, false);
} catch (e) {
  if (e instanceof Error && /WWW-Authenticate/.test(e.message)) {
    // prompt user to switch auth scheme or fix server header
  } else throw e;
}

When it happens

Trigger: CLI Digest auth call against a server whose 401 response lacks a parseable WWW-Authenticate header — e.g. a server returning Basic auth challenge, a malformed header, a non-Digest challenge, or no header at all.

Common situations: Wrong auth scheme selected (server expects Basic, not Digest); proxy strips WWW-Authenticate; server uses a non-standard digest format without quoted values; endpoint returns 401 from a generic handler that didn't set the header.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.
• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Received status: ${initialResponse.status}. Retry is disable
• Unexpected response: ${initialResponse.status}
• Failed to parse authentication parameters from WWW-Authentic
• Unexpected response: ${initialResponse.right.status}
• Fetch failed: ${error instanceof Error ? error.message : "Un

AI-assisted analysis of hoppscotch/hoppscotch@1acb8a3a75 (2026-08-12). Data as JSON: /api/errors/0f8c59ffa23bab38. Report an issue: GitHub.