DigestAuth rejects qop lists with multiple spaces or tabs

[0718lol]

DigestAuth rejects an advertised auth option when the Digest challenge uses multiple spaces or a horizontal tab around a comma in its qop list.

For example, qop="auth-int, auth" works, but qop="auth-int, auth", qop="auth-int,\tauth", and qop="auth ,auth-int" raise httpx.ProtocolError before the authenticated request is sent. I reproduced this with Client and AsyncClient on current master (b5addb64f0161ff6bfe94c124ef76f6a1fba5254, Python 3.12.15, macOS).

Minimal reproduction, without network access:

import httpx


def handler(request):
    if "Authorization" in request.headers:
        return httpx.Response(200)
    return httpx.Response(
        401,
        headers={
            "WWW-Authenticate": (
                'Digest realm="example", nonce="abc", qop="auth-int,  auth"'
            )
        },
    )


with httpx.Client(transport=httpx.MockTransport(handler)) as client:
    response = client.get(
        "https://example.org/", auth=httpx.DigestAuth("user", "password")
    )
    print(response.status_code)

Expected: select the supported auth option and complete the retry. Actual: ProtocolError: Unexpected qop value "b'auth-int, auth'" in digest auth.

RFC 2617 section 3.2.1 defines the quoted qop list using the 1#qop-value list syntax. RFC 9110 sections 5.6.1 and 5.6.3 describe optional whitespace around list commas as spaces or horizontal tabs.

The cause is _resolve_qop() splitting with re.split(b", ?", qop), which consumes at most one space after each comma and does not remove whitespace before it. A small fix is to split on commas and trim SP/HTAB from each option.

I have extended the existing client regression test. It records 8 failures and 8 passing controls on master (asyncio and trio), and 16/16 passing with the fix. All auth tests pass (97 passed, 1 skipped). A separate MockTransport handler verifies the SHA-256 response digest across sync, asyncio and trio: 12/24 pass on master and 24/24 with the fix. The full suite records 1426 passed, 1 skipped and 1 existing test_write_timeout[trio] ResourceWarning failure, also reproduced on unmodified master; see #3597. Coverage is 100%.

I checked existing qop issues, discussions and open PRs, including #3727, which still uses the existing splitting behavior. The proposed change is limited to qop list whitespace.

Implemented and tested with OpenAI Codex assistance.

Tested patch

The two-file patch is available at 0718lol/httpx commit 8513799, based on master b5addb64f0161ff6bfe94c124ef76f6a1fba5254.

A separate environment using the repository's pinned tooling passed scripts/check (Ruff 0.12.11 and mypy 1.17.1). Its full test run recorded 1425 passed, 1 skipped, and two baseline failures: Click 8.5's isolated_filesystem deprecation in test_download, and the existing trio write-timeout async-generator warning. Both failures were reproduced in an unmodified-master checkout using the same environment. Statement coverage remained 100%.

This repository currently restricts PR creation to collaborators, so no upstream PR was created. The fork commit contains the implemented fix and regression cases for review.

[0xamlab]

Confirmed on current master (b5addb6) with your MockTransport example: auth-int, auth returns 200 after two requests, while auth-int, auth, auth-int,\tauth, and auth ,auth-int each raise ProtocolError on the initial 401 challenge.

At httpx/_auth.py:332, re.split(b", ?", qop) removes at most one space after a comma and none before it. Since RFC 9110 §5.6.1 permits optional SP/HTAB around list commas, splitting on b"," and stripping b" \t" from each option is a focused fix; all four cases passed with that change.