IIS rejects standard Authorization: Digest header

The IE team has announced that IE 7 will put warning messages on Basic
Authentication username/password prompts.

So, I'm trying to get Digest Authentication set up as an alternative to
Basic Authentication.

I'm finding that IIS is rejecting Authorization: Digest headers from
Firefox, but accepting them from IE.

The Firefox header looks like this:
Authorization: Digest ... qop=auth ...

The Internet Explorer header looks like this
Authorization: Digest .... qop="auth", algorithm="MD5" ...

According to RFC 2617, Authorization headers MUST NOT put quotes around
the qop and algorithm values. So the Firefox header is right, and the
IE header is wrong.

I've only tested IIS 5. Does IIS 6 or IIS 7 accept standard
Authorization headers? If not, are there plans to fix this?

As IE has a large install base of browsers that all generate the
non-standard headers, IIS should accept both versions for a while.

See https://bugzilla.mozilla.org/show_bug.cgi?id=330702 for repro,
header logs, etc.

.

Relevant Pages

  • Re: Accessing Authenticate Header
    ... IIS configuration for anonymous access ONLY (NO Basic Authentication) ... Handler or Module reads the AUTHORIZATION header and authenticates ...
    (microsoft.public.dotnet.security)
  • Re: Accessing Authenticate Header
    ... >From my experience with building a custom authorization module, ... a basic auth header, parse it and then use the username and password from ... ability to provide authentication services. ... >> of IIS. ...
    (microsoft.public.dotnet.security)
  • How can I set "remote_user" in ISAPI filter/Extension?
    ... filter/Extension for IIS. ... HTTP_AUTHORIZATION header before the Authentication Event, IIS will process ...
    (microsoft.public.inetserver.iis.security)
  • Re: dynamically requesting windows authentication on a resource
    ... Although you can dynamically request authentication by setting a 401 Status ... and also a WWW-Authenticate header you will not be able to process these I ... This is a set of headers that IIS returns when a user requests an NTLM page. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authentication with tomcat
    ... That indicates that you have "Integrated Authentication" turned on in the ... Turn it all off except for Anonymous if you do NOT want IIS to ... I try to change IIS config, but I alway have in header "Authorization" the ... > She work fine directly in Tomcat access. ...
    (microsoft.public.inetserver.iis.security)