An issue in "DigestAuthProvider.verify": The "uri" parameter in the client's "Authorization: Digest …" response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL binding the Digest scheme assumes. Who is affected: any application using "http4k-security-digest" for HTTP Digest authentication. The bug has been present since "DigestAuthProvider" was introduced (commit "8a52b615b1", 2021).