Move noncebit to the only place it is used

Since we only allow for "auth" qop-value, hardcode it

Fixes #2408

diff --git a/requests/auth.py b/requests/auth.py
index b950181d9e4839a7c1ace822db7f401438317e66..d1c482517667e511a16cfb0208b98a3260caf95e 100644 (file)
--- a/requests/auth.py
+++ b/requests/auth.py
@@ -124,13 +124,15 @@ class HTTPDigestAuth(AuthBase):
         s += os.urandom(8)
 
         cnonce = (hashlib.sha1(s).hexdigest()[:16])
-        noncebit = "%s:%s:%s:%s:%s" % (nonce, ncvalue, cnonce, qop, HA2)
         if _algorithm == 'MD5-SESS':
             HA1 = hash_utf8('%s:%s:%s' % (HA1, nonce, cnonce))
 
         if qop is None:
             respdig = KD(HA1, "%s:%s" % (nonce, HA2))
         elif qop == 'auth' or 'auth' in qop.split(','):
+            noncebit = "%s:%s:%s:%s:%s" % (
+                nonce, ncvalue, cnonce, 'auth', HA2
+                )
             respdig = KD(HA1, noncebit)
         else:
             # XXX handle auth-int.