title: Bad request on digest authentication (User: false)
body: <p>I'm trying to implement digest authentication in my app using Passport but I've run into the following problem and can't figure out how to solve it.</p>
  
  <p>When I curl my "protected url" as follows, I get a 400 - Bad request response:</p>
  
  <pre><code>    $curl --user test:123456 --digest http://localhost:3000/users
  </code></pre>
  
  <p>You can find the complete curl request/response at the end.</p>
  
  <p>I've tried to use a custom callback for <code>passport.authenticate</code> in order to see what is it getting:</p>
  
  <pre><code>users.get('/', function(req, res, next) {
    passport.authenticate('digest', {session: false}, function(err, user, info) {
    console.log('Err: %s', err);
    console.log('User: %s', user);
    console.log('Info: %s', info);
  })(req, res, next);
  }, otherMiddleware);
  </code></pre>
  
  <p>And the result was: </p>
  
  <pre><code>Err: null
  User: false
  Info: Digest realm="Users", nonce="YTFqg2z17mYU039DvuLzONN48F0q1Xmk", qop="auth"
  </code></pre>
  
  <p>So I think that the user is not being sended correctly, but can't figure out why.</p>
  
  <p>I've configured passport to use digest authentication as follows:</p>
  
  <ul>
  <li>I've tried to left everything setted to default options, so the nonce and realm parameters are setted by passport</li>
  <li>The samples outpout have been taken on different times, that's why the nonce value is not the same.</li>
  <li>If I change the strategy to 'basic' it just works.</li>
  </ul>
  
  <p>index.js:</p>
  
  <pre><code>// ...
  var passport = require('passport);
  var usersRoute = require('./routes/users');
  
  // ...
  
  app.use(passport.initialize());
  app.use('/users', usersRoute);
  </code></pre>
  
  <p>users.js</p>
  
  <pre><code>var passport = require('passport'),
    DigestStrategy = require('passport-http').DigestStrategy,
    User = require('../../models/users');
  
  
  passport.use(new DigestStrategy({qop: 'auth'},function(username, done) {
    User.findOne({username: username}, function (err, user) {
      if (err) {return done(err);}
      if (!user) {return done(null, false);}
      return done(null, user, user.password);
    });
  }));
  
  users.get('/', passport.authenticate('digest', {session: false}), function(req, res) {
    res.send('Hi!');
  });
  </code></pre>
  
  <p>Then, when I try:</p>
  
  <pre><code>$curl --user test:123456 --digest http://localhost:3000/users
  </code></pre>
  
  <p>I get a "400 - Bad request" response.</p>
  
  <p>I left a complete output of the curl command with -v option on it.</p>
  
  <pre><code>    Eileen :: ~ » curl -v --user test:123456 --digest http://localhost:3000/users
      * Adding handle: conn: 0x7f858b803a00
      * Adding handle: send: 0
      * Adding handle: recv: 0
      * Curl_addHandleToPipeline: length: 1
      * - Conn 0 (0x7f858b803a00) send_pipe: 1, recv_pipe: 0
      * About to connect() to localhost port 3000 (#0)
      *   Trying ::1...
      *   Trying 127.0.0.1...
      * Connected to localhost (127.0.0.1) port 3000 (#0)
      * Server auth using Digest with user 'test'
      &gt; GET /users HTTP/1.1
      &gt; User-Agent: curl/7.30.0
      &gt; Host: localhost:3000
      &gt; Accept: */*
      &gt;
      &lt; HTTP/1.1 401 Unauthorized
      &lt; X-Powered-By: Express
      &lt; WWW-Authenticate: Digest realm="Users", nonce="Ah0vZigHMrDx6SMcA3cMeaFm46RtYmv9", qop="auth"
      &lt; Date: Wed, 18 Jun 2014 11:13:58 GMT
      &lt; Connection: keep-alive
      &lt; Transfer-Encoding: chunked
      &lt;
      * Ignoring the response-body
      * Connection #0 to host localhost left intact
      * Issue another request to this URL: 'http://localhost:3000/users'
      * Found bundle for host localhost: 0x7f858b4151c0
      * Re-using existing connection! (#0) with host localhost
      * Connected to localhost (127.0.0.1) port 3000 (#0)
      * Adding handle: conn: 0x7f858b803a00
      * Adding handle: send: 0
      * Adding handle: recv: 0
      * Curl_addHandleToPipeline: length: 1
      * - Conn 0 (0x7f858b803a00) send_pipe: 1, recv_pipe: 0
      * Server auth using Digest with user 'test'
      &gt; GET /users HTTP/1.1
      &gt; Authorization: Digest username="test", realm="Users", nonce="Ah0vZigHMrDx6SMcA3cMeaFm46RtYmv9", uri="/users", cnonce="ICAgICAgICAgICAgICAgICAgICAgIDE0MDMyNjc5MTY=", nc=00000001, qop=auth, response="7c7d3c5bb1b8882915d3ffe1a2b0231c"
      &gt; User-Agent: curl/7.30.0
      &gt; Host: localhost:3000
      &gt; Accept: */*
      &gt;
      &lt; HTTP/1.1 400 Bad Request
      &lt; X-Powered-By: Express
      &lt; Date: Wed, 18 Jun 2014 11:13:58 GMT
      &lt; Connection: keep-alive
      &lt; Transfer-Encoding: chunked
      &lt;
      * Connection #0 to host localhost left intact
      Bad Request%
  </code></pre>