# CPE ACS Digest Authentication is still broken

**URL:** <https://forum.genieacs.com/t/cpe-acs-digest-authentication-is-still-broken/6003>\
**Category:** Uncategorized\
**Created:** [September 30, 2024, 12:58pm UTC](https://forum.genieacs.com/t/cpe-acs-digest-authentication-is-still-broken/6003 "2024-09-30T12:58:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![adil-mafzool](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.genieacs.com/adil-mafzool/32/1921_2.png) [@adil-mafzool](https://forum.genieacs.com/u/adil-mafzool)\
**Post date:** [September 30, 2024, 12:58pm UTC](https://forum.genieacs.com/t/cpe-acs-digest-authentication-is-still-broken/6003/1 "2024-09-30T12:58:00Z")

</div>

CPE ACS Digest Authentication is still broken since in version=“1.2.13+240927064d”

> <https://github.com/genieacs/genieacs/blob/master/lib/cwmp.ts#L994>

sessionsNonces WeakMap is using sessionContext.httpRequest.socket which will different in the subsequent http request which contains the NONCE value in the Authentication header.

This meant that the value retrieve sessionsNonce in line

> <https://github.com/genieacs/genieacs/blob/master/lib/cwmp.ts#L98>

is NULL and authentication fails.

I would think it would make sense to create a Map using a deviceId but there is no object of device.

This issue is similar to : -

> [@ConnectionRequest Digest ACS - curl not the same](https://forum.genieacs.com/t/connectionrequest-digest-acs-curl-not-the-same/1063/8):
>
> Hello again, I finally found why there is a problem with the authentication with my CPE. The header HTTP “Authorization” contains all values for authentication Digest and they are correct. But the problem is there is no space between thoses values and the CPE deny the authentication. To allow this, I modified the file lib/auth.ts at line 169 by adding a space between all parameters : let authString = `Digest username="${username}"`; authString += `, realm="${authHeader.realm}"`; aut…