philsturgeon/codeigniter-restserver — Issue #68: Not following RFC 2617 standard in Digest authentication 
Author: Fresa
Created: 2011-11-12 13:20:12+00:00
State: open

After lots and lots of hours debugging why Digest authentication between REST_Controller and spring rest client doesn't work, I noticed you are not following the RFC 2617 standard in sending the digest authentication header response.

All parameters in the header response should be seperated by commas. Please refer to the RFC 2617 document, section 3.5, at http://tools.ietf.org/html/rfc2617#section-3.5.

Not using comma separated parameters in the response causes clients to not be able to interpretate the response correctly.

I have tested the v2.2 of the REST_Controller for this problem, but I can see that the problem persists in the latest 2.5 build as well.

Please adjust line 629 (v2.2), 772 (v2.5)
From:
header('WWW-Authenticate: Digest realm="' . $this->config->item('rest_realm') . '" qop="auth" nonce="' . $nonce . '" opaque="' . md5($this->config->item('rest_realm')) . '"');

To:
header('WWW-Authenticate: Digest realm="'.$this->config->item('rest_realm'). '", qop="auth", nonce="'.$nonce.'", opaque="'.md5($this->config->item('rest_realm')).'"');

Best regards
//Fredrik