title: When sending WW-Authenticate header of digest authentication with SHA-256 with Java Servlet, the client side does not return the result
body: <p>I am developing a Web API that performs Digest authentication, but when I set the message digest algorithm to SHA-256, the client side seems to crash.
  Is there something wrong with the server-side implementation?</p>
  <p>Language: Java, Server: Tomcat7.0
  OS: Windows 10 for both server and client</p>
  <p>Digest authentication does not use tomcat's web.xml, server.xml, or tomcat-users.xml settings, but implements sending WWW-Authenticate header and receiving Authorization header in Servlet.
  At this time, if MD5 is used as the algorithm of the digest, authentication will succeed, but if you change to SHA-256 because it is deprecated, the client side will not return the result after sending the WW-Authenticate header .</p>
  
  <p>WWW-Authenticate: Digest realm = &quot;example.com&quot;, qop = auth, nonce = &quot;f5d6eeccc66664731c72e3300d3dfadf&quot;, opaque = &quot;56b2ea6d037b522661a3719ec48b7d9a&quot;, algorithm = SHA-256</p>
  <ul>
  <li>Successful when algorithm = MD5</li>
  </ul>
  
  <p>(In the case of browser)</p>
  <p>An error occurs in Http status 401 without displaying the dialog for entering the user and password.
  Looking at the communication status with the developer tools, it seems that WWW-Authenticate: is received, but it does not seem to generate Authorization header.</p>
  <p>(curl command)</p>
  <p>curl -v -k --digest --use r &quot;user: password&quot; &quot;url&quot;</p>
  <p>After receiving the WWW-Authenticate header, curl exits with an out of memory message</p>