Bug #70101 [Com]: curl with digest authentication does work (all the time)

Edit report at https://bugs.php.net/bug.php?id=70101&edit=1 ID: 70101 Comment by: gohel at basicguru dot de Reported by: roeycohen at gmail dot com Summary: curl with digest authentication does work (all the time) Status: Open Type: Bug Package: cURL related Operating System: windows and linux PHP Version: 5.6.11 Block user comment: N Private report: N New Comment: I am experiencing same problem now on PHP 7.0.20 x86, Windows x64. It instead to work as expected on the same PHP installation, but with the Curl-Lib from PHP 7.0.14. Previous Comments: ------------------------------------------------------------------------ [2015-12-28 16:33:14] gohel at basicguru dot de I have the same problem with PHP-clients/scripts and the CalDAV/SabreDAV-framework (also included in Owncloud, Baikal, etc.) on my Apache 2.4.17 (Win32/VC11 from Apachelounge on Win7/64). I've played a little bit with different versions of the PHP 5.6.x releases and found the following: php_curl.dll <= v5.6.4 - no problems php_curl.dll v5.6.5/v5.6.6 - crash with Auth_Digest php_curl.dll => v5.6.7 - Auth_Digest failed The bug is also in the PHP 5.5 release and PHP 5.4 (last stable PHP_CURL.DLL I've found in v5.4.36) ------------------------------------------------------------------------ [2015-10-26 17:37:47] dougk dot ff7 at gmail dot com One last post, with working httpbin.org support (note that they test for the presence of a fake cookie -- instead of setting up a cookie jar, I've just passed back the fake cookie): <?php $curl = curl_init(); $curl_options = [ CURLOPT_HTTPAUTH => CURLAUTH_ANY, CURLOPT_USERPWD => 'user:passwd', CURLOPT_URL => 'http://httpbin.org/digest-auth/auth/user/passwd', CURLOPT_HEADER => true, CURLOPT_VERBOSE => true, CURLOPT_COOKIE => 'fake=fake_value' ]; curl_setopt_array($curl, $curl_options); curl_exec($curl); curl_close($curl); ?> ------------------------------------------------------------------------ [2015-10-26 16:46:56] dougk dot ff7 at gmail dot com One other note: it seems curl in general is having issues with httpbin's digest test service (I have the same issues with both curl and wget on the command line)... this one seems to work fine (hosted by webdav.org), though it returns a 404: <?php $curl = curl_init(); $curl_options = [ CURLOPT_HTTPAUTH => CURLAUTH_ANY, #CURLOPT_USERPWD => 'user:passwd', #CURLOPT_URL => 'http://httpbin.org/digest-auth/auth/user/passwd', CURLOPT_USERPWD => 'user1:user1', CURLOPT_URL => 'http://test.webdav.org/auth-digest', CURLOPT_HEADER => true, CURLOPT_VERBOSE => true ]; curl_setopt_array($curl, $curl_options); curl_exec($curl); curl_close($curl); ?> ------------------------------------------------------------------------ [2015-10-26 16:21:32] dougk dot ff7 at gmail dot com On Windows specifically, this seems to be related to the change to using SSPI with cURL. curl_sasl_sspi.c adds "Curl_override_sspi_http_realm()" in curl-7.43.0. Going all the way back to php-5.3.29 works (php-5.4 through php-5.5 crash due to the aforementioned bug). Building my own version of cURL based on 7.43.0 (from [1]) and building it into php-5.6.14 manually works as expected. Note that this only explains the Windows case of this issue (where Realm is sent back to the server as an empty string). This can be verified using CURLOPT_VERBOSE = true. [1] https://github.com/winlibs/cURL ------------------------------------------------------------------------ [2015-08-10 10:06:48] luca dot horn at gmail dot com I am experiencing same problem on PHP 5.6.12 x86, cURL 7.42.1, Windows 8.1 x64. It instead seems to work as expected on my Ubuntu machine (running PHP 5.6.11 and cURL 7.35.0). ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=70101 -- Edit this bug report at https://bugs.php.net/bug.php?id=70101&edit=1