# HTTP Digest Authentication PUT DELETE problem. Bug?

**URL:** <https://www.ruby-forum.com/t/http-digest-authentication-put-delete-problem-bug/163405>\
**Category:** Rails\
**Created:** [March 20, 2009, 12:15am UTC](https://www.ruby-forum.com/t/http-digest-authentication-put-delete-problem-bug/163405 "2009-03-20T00:15:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![greq](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/d07c76/32.png) [@greq](https://www.ruby-forum.com/u/greq)\
**Post date:** [March 20, 2009, 12:15am UTC](https://www.ruby-forum.com/t/http-digest-authentication-put-delete-problem-bug/163405/1 "2009-03-20T00:15:27Z")

</div>

Hi all,

I’ve got a problem with HTTP Digest Authentication after upgrading  
Rails to 2.3.2.  
It seems that it is broken for PUT and DELETE requests method.  
Here is what I did:

1. Generate new rails app in rails 2.3.2
2. Added sample scaffold model Post name:string
3. Added simple HTTP Digest Authentication filter to application  
controller:

|----------------code----------------- |  
USERS = { ‘lifo’ =\> ‘world’, ‘pretty’ =\> ‘please’, ‘a’ =\> ‘b’}

before\_filter :digest\_authenticate

def digest\_authenticate  
authenticate\_or\_request\_with\_http\_digest do |login|  
USERS[login]  
end  
end  
|---------------- code -----------------|

It works fine for index, new, create and show action, but for destroy  
(DELETE) and update(PUT) htaccess popup apears and don’t allow to  
update or delete( of course for I put correct login/password data :))

Have you got also problem with this ?  
I’ve reviewed action\_pack source code and it seems that in lines:  
[http://github.com/rails/rails/blob/18eb80ccc7e932f9a6c00462ceaeea648631b120/actionpack/lib/action\_controller/http\_authentication.rb(197,198)](http://github.com/rails/rails/blob/18eb80ccc7e932f9a6c00462ceaeea648631b120/actionpack/lib/action_controller/http_authentication.rb(197,198))

expected = expected\_response(request.env[‘REQUEST\_METHOD’], request.env  
[‘REQUEST\_URI’], credentials, password, password\_is\_ha1)  
expected == credentials[:response]

there are different values generated for PUT and DELETE request  
method.

Regards

Grzesiek F.

---

<div class="post-metadata">

**Author:** ![greq](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/d07c76/32.png) [@greq](https://www.ruby-forum.com/u/greq)\
**Post date:** [March 27, 2009, 10:03pm UTC](https://www.ruby-forum.com/t/http-digest-authentication-put-delete-problem-bug/163405/2 "2009-03-27T22:03:20Z")

</div>

I’ve run into the same problem. GET and POST work find, but PUT and  
DELETE repeatedly asks for login information and never succeeds.

---

<div class="post-metadata">

**Author:** ![greq](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/d07c76/32.png) [@greq](https://www.ruby-forum.com/u/greq)\
**Post date:** [April 15, 2009, 5:22pm UTC](https://www.ruby-forum.com/t/http-digest-authentication-put-delete-problem-bug/163405/3 "2009-04-15T17:22:50Z")

</div>

This is a bug in Rails 2.3.2. I’ve created a Lighthouse ticket for it  
(#2490) and created a patch that fixes it. It will probably help get  
the fix into a release if others acknowledge the problem and can  
verify my patch fixes it for them.

[https://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/2490-http-digest-auth-uses-wrong-request-method-for-put-delete#ticket-2490-1](https://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/2490-http-digest-auth-uses-wrong-request-method-for-put-delete#ticket-2490-1)