diff --git a/src/requests/auth.py b/src/requests/auth.py index 4a7ce6dc14..dbe6e13a97 100644 --- a/src/requests/auth.py +++ b/src/requests/auth.py @@ -183,9 +183,13 @@ def sha512_utf8(x): p_parsed = urlparse(url) #: path is request-uri defined in RFC 2616 which should not be empty path = p_parsed.path or "/" + + # Normalize path by removing excess leading slashes (same as adapters.py) + if path.startswith("//"): + path = f"/{path.lstrip('/')}" + if p_parsed.query: path += f"?{p_parsed.query}" - A1 = f"{self.username}:{realm}:{self.password}" A2 = f"{method}:{path}" diff --git a/tests/test_requests.py b/tests/test_requests.py index 75d2deff2e..5d021da880 100644 --- a/tests/test_requests.py +++ b/tests/test_requests.py @@ -805,6 +805,30 @@ def test_DIGESTAUTH_QUOTES_QOP_VALUE(self, httpbin): r = requests.get(url, auth=auth) assert '"auth"' in r.request.headers["Authorization"] + def test_DIGEST_AUTH_NORMALIZES_DOUBLE_SLASH_PATH(self): + """Digest auth URI should normalize double slashes to match request path. + + Regression test for GitHub issue #6784. + """ + auth = HTTPDigestAuth("user", "pass") + auth.init_per_thread_state() + + # Simulate server challenge + auth._thread_local.chal = { + "realm": "test", + "nonce": "abc123", + "qop": "auth", + "algorithm": "MD5" + } + + # URL with double slash in path + url = "http://example.com//path/to/resource" + header = auth.build_digest_header("GET", url) + + # The URI should be normalized to single slash + assert 'uri="/path/to/resource"' in header + assert 'uri="//path/to/resource"' not in header + def test_POSTBIN_GET_POST_FILES(self, httpbin): url = httpbin("post") requests.post(url).raise_for_status()