[orsenthil]

HTTPDigestAuthHandler and ProxyDigestAuthHandler only looked at the first WWW-Authenticate / Proxy-Authenticate header and took its first word as the scheme. As a result:

• A Digest challenge was ignored if a Basic challenge came first, in the same header or in an earlier one.

• An unsupported scheme listed first (for example Kerberos, Basic realm="x") raised ValueError. Because the Digest handler runs before the Basic handler, that also blocked HTTPBasicAuthHandler.

This PR changes only AbstractDigestAuthHandler.
AbstractBasicAuthHandler already handles multiple challenges since GH-18284 and is not modified.

• http_error_auth_reqed() now reads all headers (get_all()) and uses the first Digest challenge found. It raises ValueError only when neither Digest nor Basic is offered; otherwise it returns None so the next handler can try.

• A new private _parse_challenges() splits a header into challenges per RFC 9110 §11.6.1. A comma-separated element that starts with a word not followed by = begins a new challenge. Its quote/escape handling matches parse_http_list(). It makes a single linear pass with no regex.

• retry_http_digest_auth() is unchanged. It receives the original text of the Digest challenge, so escapes are not processed twice. For a single-challenge header the string is the same as before.

🤖 Generated with Claude Code

---

I have reviewed the logic and changes done by claude. This is the most compact way to address requirement in the long pending issue gh-59515

• Issue: urllib: Support for multiple WWW-Authenticate headers and/or multiple challenges per header #59515