philsturgeon/codeigniter-restserver — Issue #67: Digest auth couldn't work with IE8
Author: LiuZhiyan
Created: 2011-11-09 11:07:56+00:00
State: open

GET Request:
WWW-Authenticate: Digest realm="REST API" qop="auth" nonce="4eba4f8591de5" opaque="aba3d4b49c454e1974970e7b5514b001" algorithm="MD5"

Response:
Authorization: Digest username="admin",realm="REST API" qop="auth" nonce="4eba4f8591de5" opaque="aba3d4b49c454e1974970e7b5514b001",nonce="4eba4f8591de5",uri="/auction/result",cnonce="a9cf78826c1a441a367627549e03cfc1",nc=00000001,response="c1d351b4c87729bbc94447f61551d376",qop="auth",opaque="aba3d4b49c454e1974970e7b5514b001"

Key code:
$A1 = md5($digest['username'] . ':' . $this->config->item('rest_realm') . ':' . $valid_pass);
$A2 = md5(strtoupper($this->request->method) . ':' . $digest['uri']);
EXPECTED RESPONSE = $A1 . ':' . $digest['nonce'] . ':' . $digest['nc'] . ':' . $digest['cnonce'] . ':' . $digest['qop'] . ':' . $A2;

EXPECTED RESPONSE value is "4495f0bb3634d4b629b89a72009d514a". But under my IE8 (8.0.6001.18702), response is "c1d351b4c87729bbc94447f61551d376". Why? Digest auth could work with my Firefox8.

BTW: Can anyone tell me why Chrome does not popup authorization dialogue box? (http://www.google.com/support/forum/p/Chrome/thread?tid=79d3a183e70ede42&hl=en)