mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-08-20 00:55:02 +00:00
abf525d78c
detail::parse_www_authenticate() assumed a single challenge starting at the first space in the field value and read only its first occurrence, so a Basic challenge listed before Digest (or split across two field lines, as some servers do) hid the Digest challenge entirely, and a second Digest challenge with different parameters (RFC 7616 offering both SHA-256 and MD5) could mix params from both. Combine repeated field lines the same way the other list-valued headers do, then split on commas that aren't inside a quoted-string so a quoted realm can contain a comma, and track which challenge each auth-param belongs to by the auth-scheme token that starts it. Also require at least one auth-param before reporting a Digest challenge as found, since an empty challenge can't produce a usable Authorization header.
