From 55ead904eff7376ccbc7f23e93be19117c642441 Mon Sep 17 00:00:00 2001
From: Kadir Can Ozden <101993364+bysiber@users.noreply.github.com>
Date: Fri, 20 Feb 2026 03:36:40 +0300
Subject: [PATCH] Fix `unquote` IndexError on empty string input

`unquote('')` raises `IndexError` because it accesses `value[0]`
without checking the string length first. This can occur when parsing
digest auth WWW-Authenticate headers containing parameters with empty
unquoted values (e.g. `realm=` instead of `realm=""`).
---
 httpx/_utils.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/httpx/_utils.py b/httpx/_utils.py
index 7fe827da4d..41707d8117 100644
--- a/httpx/_utils.py
+++ b/httpx/_utils.py
@@ -89,7 +89,9 @@ def to_bytes_or_str(value: str, match_type_of: typing.AnyStr) -> typing.AnyStr:
 
 
 def unquote(value: str) -> str:
-    return value[1:-1] if value[0] == value[-1] == '"' else value
+    if len(value) >= 2 and value[0] == value[-1] == '"':
+        return value[1:-1]
+    return value
 
 
 def peek_filelike_length(stream: typing.Any) -> int | None: