Microsoft Edge PHP authentication not working without index.php in URL

Question

At work we have a platform for a customer, requiring their employees to log in using HTTP Digest. To browse to the site, they type something like theircompany.mycompany.com . In Chrome/IE/FireFox, they can log in.

However, in Microsoft Edge, they can only log in if they type theircompany.mycompany.com/index.php . If they don't, the authentication screen keeps showing up, even after correctly entering their credential and the network section in the developer tools shows 401 Unauthorised .

Does anyone know about this issue, how to fix it, or how to use a workaround next to actually appending index.php?

-EDIT- Below is the vhost file used for the site in question.

<VirtualHost *:80>
  ServerName theircomapny.mycompany.com

  LogLevel error
  CustomLog ${APACHE_LOG_DIR}/theircomapny.mycompany.com-access.log combined
  ErrorLog ${APACHE_LOG_DIR}/theircomapny.mycompany.com-error.log
  DocumentRoot /var/www/theircompany

<Directory /var/www/theircompany>
    Options -Indexes +FollowSymLinks -MultiViews
    AllowOverride None
    Order allow,deny
    allow from all
</Directory>

  RewriteEngine on
  RewriteCond %{HTTPS} !^on$ [NC]
  RewriteRule . https://%{HTTP_HOST}%{REQUEST_URI}  [L]

</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
  ServerName theircomapny.mycompany.com

  LogLevel error
  CustomLog ${APACHE_LOG_DIR}/theircomapny.mycompany.com-access.log combined
  ErrorLog ${APACHE_LOG_DIR}/theircomapny.mycompany.com-error.log
  DocumentRoot /var/www/theircompany

<Directory /var/www/theircompany>
    Options -Indexes +FollowSymLinks -MultiViews
    AllowOverride None
    Order allow,deny
    allow from all
</Directory>

<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>

BrowserMatch "MSIE [2-6]" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

-EDIT- I have just tried to reproduce the issue using a fresh MAMP installation and the sample code from example #2 located here

Exactly the same happens, so I doubt it is any .htaccess issue.

Answer 1

This (failure to send an Authorization: Digest header on a re-request for the root path) is indeed a bug in Edge Legacy (reproing in the latest Windows 10 2004 builds), and a regression from Internet Explorer 11 which works properly.

It's fixed in the new Microsoft Edge (based on Chromium).