🐛 Ensure that `HTTPDigest` only raises an exception when `auto_error is True` (#2939)

Co-authored-by: svlandeg <sofie.vanlandeghem@gmail.com>

fastapi/security/http.py

@@ -413,8 +413,11 @@ class HTTPDigest(HTTPBase):
             else:
                 return None
         if scheme.lower() != "digest":
-            raise HTTPException(
-                status_code=HTTP_403_FORBIDDEN,
-                detail="Invalid authentication credentials",
-            )
+            if self.auto_error:
+                raise HTTPException(
+                    status_code=HTTP_403_FORBIDDEN,
+                    detail="Invalid authentication credentials",
+                )
+            else:
+                return None
         return HTTPAuthorizationCredentials(scheme=scheme, credentials=credentials)

tests/test_security_http_digest_optional.py

@@ -37,8 +37,8 @@ def test_security_http_digest_incorrect_scheme_credentials():
     response = client.get(
         "/users/me", headers={"Authorization": "Other invalidauthorization"}
     )
-    assert response.status_code == 403, response.text
-    assert response.json() == {"detail": "Invalid authentication credentials"}
+    assert response.status_code == 200, response.text
+    assert response.json() == {"msg": "Create an account first"}
 
 
 def test_openapi_schema():