iOS WebDAV: Doesn't work with Digest authentication

dstillman Zotero Team
This discussion was created from comments split from: iOS: WebDAV verification still fails (build 166).
  • mainland
    Here’s mine too D2075069929

    WebDAV worked perfectly with build 165. With 168, I can neither verify the WebDAV server nor can I download any files stored on the server.
  • dstillman Zotero Team
    edited November 21, 2021
    "Www-Authenticate" : "Digest realm=\"WebDAV\"
    @mainland: Zotero doesn't support Digest authentication, only Basic. (I believe this is the case in the desktop app too. If this is working for you with the desktop app, we'd want to see a Debug ID for verifying the server with that.)
  • mainland
    @dstillman: Here is a debug ID for current beta (Linux) desktop where I successfully verified against the same WebDAV account: D28044288.

    This same WebDAV account worked fine with build 165 of the iOS client. Was support for digest authentication removed as of build 165?
  • dstillman Zotero Team
    Sorry, can you provide a Debug ID for the first Verify Server since starting the desktop app?
    Was support for digest authentication removed as of build 165?
    The initial method we were using to specify credentials may have supported Digest Auth accidentally, but authentication wasn't working properly for many users due to what seemed to be buggy HTTP authentication handling iOS, so we switched to explicit Basic Auth.

    We can look into whether we're able to support Digest as well.
  • mainland
    @dstillman: Hopefully this has what you're looking for: D1088766748

    Thank you!
  • francisrlee
    edited November 23, 2021
    @dstillman Digest authentication definately works in the Mac Desktop version of the app. I have set up a personal apache2 webdav server with digest authentication. This has worked well for years.

    As @mainland the digest authentication worked well in a previous version of the ios beta app. It does not work in build 168. The apache log gives error "401 Unauthorized" when trying to log in.

    Digest is more secure than basic authentication, so I hope that this will be implemented. See https://httpd.apache.org/docs/2.4/mod/mod_dav.html#security.

    Thanks for this!
  • dstillman Zotero Team
    The latest iOS build restores Digest Authentication support.
Sign In or Register to comment.