nc must be incremented each time when nc is used.

nc isn't used if qop isn't used so the existing code appears to be correct. If you are referring the latest RFC requiring qop you can see that libcurl has some legacy compatibility and can operate without qop (and therefore nc). Sorry but I just don't see this as an improvement, IMO it's clearer as is.

Oops I missed your title... you are right the increment is missing for auth-int. I think in that case it could still be handled in the if block for qop.

Oops I missed your title... you are right the increment is missing for auth-int. I think in that case it could still be handled in the if block for qop.

The additional idea was to use nc as an indication of nonce used at least one time, but this could be handled in another commit.

I know that digest HTTP auth is defined by RFC 7616, RFC 2617, and (old, deprecated, but still supported) RFC 2069.

Let me know if it needs any further improvements.

Thanks