* modules/aaa/mod_auth_digest.c (add_auth_info): Don't add

  (Proxy-)Authentication-Info headers to 401/407 responses.

GitHub: PR #661


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935954 13f79535-47bb-0310-9956-ffa450edef68

Author: notroj

modules/aaa/mod_auth_digest.c

@@ -1650,8 +1650,14 @@ static int add_auth_info(request_rec *r)
         return OK;
     }
 
-    /* setup nextnonce
-     */
+    /* Don't add Authentication-Info for 401/407 responses. */
+    if (apr_table_get(r->err_headers_out,
+                      (r->proxyreq == PROXYREQ_PROXY)
+                      ? "Proxy-Authenticate" : "WWW-Authenticate")) {
+        return OK;
+    }
+
+    /* Set up nextnonce for one-time-nonces and expiring-nonce cases. */
     if (conf->nonce_lifetime > 0) {
         /* send nextnonce if current nonce will expire in less than 30 secs */
         if ((r->request_time - resp->nonce_time) > (conf->nonce_lifetime-NEXTNONCE_DELTA)) {