Summary

DigestAuth rejects valid challenges such as Digest Realm="example", Nonce="abc". Uppercase optional parameter names can also silently drop qop/opaque or select MD5 instead of the advertised algorithm. Whitespace around = causes the same parsing problem.

RFC 9110 §11.2 defines case-insensitive authentication parameter names and permits whitespace around the separator. Normalize names and surrounding whitespace before looking up parameters, preserving case and whitespace inside quoted values.

Extend the existing SHA-256 RFC vector across individual uppercase parameters and space/tab separators, asserting the same digest. Add a regression for preserving quoted whitespace.

Locally on Python 3.15.0:

• Before the fix: 21 regression cases fail; the original RFC vector passes.
• After the fix: all 2,117 tests pass, including 112 authentication tests.
• scripts/coverage passes at 100% (14,914 statements).
• scripts/check passes: lock consistency, formatting, mypy, Ruff and unasync consistency.

Hosted CI now passes on Python 3.11–3.15, including package/docs builds, checks and coverage (Test Suite). Automated reviews report no findings. CodSpeed reports 18 unchanged benchmarks and seven skipped benchmarks using baseline results; this does not establish performance for the skipped cases. Human maintainer review is still pending.

Checklist

• I understand that this PR may be closed in case there was no previous discussion.
• I've added a test for each change and kept the fix to the Digest challenge parser.
• Documentation reviewed; no new API or configuration to document.

AI-assisted investigation, implementation and local validation with Codex.