php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Doc Bug #37371 WWW-Authenticate requires commas
Submitted: 2006-05-08 22:46 UTC Modified: 2006-05-08 23:09 UTC
From: cyberscribe@php.net Assigned: simp (profile)
Status: Closed Package: Documentation problem
PHP Version: Irrelevant OS: n/a
Private report: No CVE-ID: None
View Developer Edit
 [2006-05-08 22:46 UTC] cyberscribe@php.net 
Description:
------------
In the Digest example on

http://php.net/features.http-auth

the auth, qop, nonce, and opaque values for the WWW-Authenticate header are not separated  by commas. 

This works fine for browsers like Firefox, but does not work when authenticating with Internet Explorer or Opera. So, for maximum compatability, be sure to separate the key/value pair elements of the WWW-Authenticate header with commas.

I'm not sure what the RFCs say; I just know what works.

And I think it's strange that the comment I posted with the same information was deleted -- since it could save someone like me in a similar situation a lot of pain and frustration until someone on the Doc team gets around to changing this...

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-05-08 22:58 UTC] simp@php.net 
You're right. RFC 2617 also says so:
"It uses an extensible, case-insensitive token to identify the authentication scheme, followed by a comma-separated list of attribute-value pairs which carry the parameters necessary for achieving authentication via that scheme."
 [2006-05-08 23:09 UTC] simp@php.net 
This bug has been fixed in the documentation's XML sources. Since the
online and downloadable versions of the documentation need some time
to get updated, we would like to ask you to be a bit patient.

Thank you for the report, and for helping us make our documentation better.

    header('WWW-Authenticate: Digest realm="'.$realm.          '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');

Authentication parameters have to be comma-separated as seen in the digest example above.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Wed Nov 19 16:00:01 2025 UTC