Skip to content

Commit 37f4199

Browse files
author
Open Source Contributor
committed
Fix HTTPDigestAuth non-latin credentials encoding
When HTTPDigestAuth credentials are passed as bytes (e.g. encoded UTF-8), they were being used directly in the digest header without decoding, resulting in headers like Digest username="b'Ond\xc5\x99ej'" instead of the properly decoded username. This fix decodes bytes username/password to strings before using them in the digest A1 computation and the username header field. Fixes #6102
1 parent 04d7505 commit 37f4199

1 file changed

Lines changed: 15 additions & 2 deletions

File tree

src/requests/auth.py

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,16 @@ def KD(s: str, d: str) -> str:
218218
if p_parsed.query:
219219
path += f"?{p_parsed.query}"
220220

221-
A1 = f"{self.username}:{realm}:{self.password}"
221+
if isinstance(self.username, bytes):
222+
username = self.username.decode("utf-8")
223+
else:
224+
username = self.username
225+
if isinstance(self.password, bytes):
226+
password = self.password.decode("utf-8")
227+
else:
228+
password = self.password
229+
230+
A1 = f"{username}:{realm}:{password}"
222231
A2 = f"{method}:{path}"
223232

224233
HA1 = hash_utf8(A1)
@@ -250,8 +259,12 @@ def KD(s: str, d: str) -> str:
250259
self._thread_local.last_nonce = nonce
251260

252261
# XXX should the partial digests be encoded too?
262+
if isinstance(self.username, bytes):
263+
username_header = self.username.decode("utf-8")
264+
else:
265+
username_header = self.username
253266
base = (
254-
f'username="{self.username}", realm="{realm}", nonce="{nonce}", '
267+
f'username="{username_header}", realm="{realm}", nonce="{nonce}", '
255268
f'uri="{path}", response="{respdig}"'
256269
)
257270
if opaque:

0 commit comments

Comments
 (0)