Client Digest Authentication with POCO

Question

I'm using POCO for some service client. Client should login with digest authentication.

POCO documentation claims that digest authentication is supported .

This is a utility class for working with HTTP authentication (basic or digest ) in HTTPRequest objects.

Here is full source of test (gtest) showing that there is some problem:

#include "UnitTest.h"
#include <Poco/Net/HTTPRequest.h>
#include <Poco/Net/HTTPResponse.h>
#include <Poco/Net/HTTPSClientSession.h>
#include <Poco/Net/HTTPClientSession.h>
#include <Poco/StreamCopier.h>
#include <Poco/Net/HTTPCredentials.h>

using namespace Poco::Net;

TEST(PocoDigestAuthTest, HttpBibOrgTest) {
    HTTPClientSession session;
    session.setHost("httpbin.org");

    HTTPRequest request(
        "GET", 
        // "http://httpbin.org/basic-auth/user/passwd", // basic
        "http://httpbin.org/digest-auth/auth/user/passwd",  // digest
        HTTPMessage::HTTP_1_1);
    session.sendRequest(request);

    HTTPResponse response;
    std::istream& firstResponseStream = session.receiveResponse(response);
    std::stringstream firstStrStream;
    Poco::StreamCopier::copyStream(firstResponseStream, firstStrStream);

    ASSERT_EQ(HTTPResponse::HTTP_UNAUTHORIZED, response.getStatus());

    HTTPCredentials creds("user", "passwd");
    creds.authenticate(request, response);
    session.sendRequest(request);

    std::istream& bodyStream = session.receiveResponse(response);
    EXPECT_NE(HTTPResponse::HTTP_UNAUTHORIZED, response.getStatus());
    EXPECT_EQ(HTTPResponse::HTTP_OK, response.getStatus());

    std::stringstream strStream;
    Poco::StreamCopier::copyStream(bodyStream, strStream);
    EXPECT_NE("", strStream.str());
}

This test fails where status HTTP_OK is expected, I'm getting 401 (HTTP_UNAUTHORIZED) so earlier check also fails.

If I change uri to site with basic authentication, everything works as expected (test passes).

What I'm doing wrong? Or is it a bug in POCO? Can I fix it somehow?

Answer 1

After some testing and mind bending it turned out that the issue has nothing to do with digest authentication. You'll also need to send the cookie (fake=fake_value) set by the httpbin.org server. Here is a modified version of your sample that works. Note the additional call to setCookies(). Also, when creating the HTTPRequest, only the path needs to be supplied, not the entire URI.