| Subject: | digest authentication's stale nonce not handled |
When an LWP::UserAgent instance authenticates repeatedly against a
server using digest authentication, the re-used server supplied "nonce"
token may eventually expire.
In this case the server responds with 401, plus header values specifying
the nonce is stale.
The user agent now returns the 401 response to the caller. Shouldn't it
re-authenticate silently using the updated nonce instead?
Tested with libwww-perl-6.04, perl 5.10.1, Linux 2.6.32-5-amd6
against Apache 1.3 mod_auth_digest (and some IIS implementation).