== GHSA digest-auth fix source verification ==
fix commit: 2116686308a2518bf1851a39eeec738f1e901195 (Bump github.com/containous/go-http-auth to b975dcaa8c48)
using cached repo mirror: /pruva/project-cache/repo-mirrors/traefik.git
tag v2.11.54 commit=1e8e8c200cce5fbd1fff8579e5e9dc0311a8a54a contains_fix_commit=NO fork_pin=github.com/abbot/go-http-auth => github.com/containous/go-http-auth v0.4.1-0.20200324110947-a37a7636d23e
tag v2.11.55 commit=1ac90fccb982f6de40f557493152bdb0c9f0a809 contains_fix_commit=YES fork_pin=github.com/abbot/go-http-auth => github.com/containous/go-http-auth v0.4.1-0.20260804094822-b975dcaa8c48
tag v3.6.11 commit=33219a0af86c41a8db81d37c444f65172bfb3e35 contains_fix_commit=NO fork_pin=github.com/abbot/go-http-auth => github.com/containous/go-http-auth v0.4.1-0.20200324110947-a37a7636d23e
tag v3.6.12 commit=b782bd32d444af99d76e5f87970b02a9aa80ba97 contains_fix_commit=NO fork_pin=github.com/abbot/go-http-auth => github.com/containous/go-http-auth v0.4.1-0.20200324110947-a37a7636d23e
tag v3.7.11 commit=faa1eb590646aed94e561e24a59be0c47353ae95 contains_fix_commit=YES fork_pin=github.com/abbot/go-http-auth => github.com/containous/go-http-auth v0.4.1-0.20260804094822-b975dcaa8c48
== fork fix hunk (a37a7636d23e -> b975dcaa8c48, digest.go) ==
diff --git a/digest.go b/digest.go
index 627f71c..ecbd5b5 100644
--- a/digest.go
+++ b/digest.go
@@ -189,6 +189,9 @@ func (da *DigestAuth) CheckAuth(r *http.Request) (username string, authinfo *str
 	}
 
 	HA1 := da.Secrets(auth["username"], da.Realm)
+	if HA1 == "" {
+		return "", nil
+	}
 	if da.PlainTextSecrets {
 		HA1 = H(auth["username"] + ":" + da.Realm + ":" + HA1)
 	}