This is a backport of PR #10725 as merged into master (ab76c5a).

What do these changes do?

Implementation Details

This middleware implements RFC 7616.

The implementation fully complies with the RFC specifications, including:

• Support for all standard hash algorithms (MD5, SHA-256, SHA-512) and their session variants
• Proper nonce counting and opaque value handling as required by the RFC
• Support for both "auth" and "auth-int" quality of protection (qop) methods
• Complete implementation of the authentication challenge/response flow

Changes

This PR adds:

• A new DigestAuthMiddleware class that handles HTTP Digest Authentication
• Support for multiple hashing algorithms (MD5, SHA-256, SHA-512)
• Implementation of both "auth" and "auth-int" quality of protection (qop)
• Automatic handling of authentication challenges and retries
• Proper nonce counting and opaque value handling
• Support for modern hashing algorithms as specified in RFC 7616

Are there changes in behavior for the user?

There are no changes to default behavior. It will continue to use BasicAuth, and existing uses of BasicAuth should be intact.

Is it a substantial burden for the maintainers to support this?

no

Related issue number

replaces and closes #2213 closes #4939

Checklist

• I think the code is well written
• Unit tests for the changes exist
• Documentation reflects the changes
• If you provide code modification, please add yourself to CONTRIBUTORS.txt
  • The format is <Name> <Surname>.
  • Please keep alphabetical order, the file is sorted by names.
• Add a new news fragment into the CHANGES/ folder

  • name it <issue_or_pr_num>.<type>.rst (e.g. 588.bugfix.rst)

  • if you don't have an issue number, change it to the pull request
    number after creating the PR

    • .bugfix: A bug fix for something the maintainers deemed an
      improper undesired behavior that got corrected to match
      pre-agreed expectations.
    • .feature: A new behavior, public APIs. That sort of stuff.
    • .deprecation: A declaration of future API removals and breaking
      changes in behavior.
    • .breaking: When something public is removed in a breaking way.
      Could be deprecated in an earlier release.
    • .doc: Notable updates to the documentation structure or build
      process.
    • .packaging: Notes for downstreams about unobvious side effects
      and tooling. Changes in the test invocation considerations and
      runtime assumptions.
    • .contrib: Stuff that affects the contributor experience. e.g.
      Running tests, building the docs, setting up the development
      environment.
    • .misc: Changes that are hard to assign to any of the above
      categories.

  • Make sure to use full sentences with correct case and punctuation,
    for example:

    Fixed issue with non-ascii contents in doctest text files
    -- by :user:`contributor-gh-handle`.

    Use the past tense or the present tense a non-imperative mood,
    referring to what's changed compared to the last released version
    of this project.