Required: authentication realm.
Required: server-provided nonce (used once).
OptionalopaqueOpaque data echoed back by the client (if provided by server).
Hash algorithm (default: "MD5"). RFC 7616 also defines "SHA-256", "SHA-512-256".
OptionalqopQuality of protection: "auth", "auth-int", or a comma-separated list.
Optionalstaletrue if the nonce is stale and a retry is allowed without user interaction.
OptionaldomainSpace-separated list of URL prefixes protected by this challenge.
OptionalcharsetCharacter encoding expected by the server (e.g. "UTF-8").
Optionaluserhashtrue if the server supports hashed username (RFC 7616 §3.4.4).
Parameters extracted from a
WWW-Authenticate: Digestchallenge header.