I think I've found the actual problem: having a querystring at the end of the URL stops the HttpAuthDigiestModule from working correctly.

In fact, simply appending a question mark at the end of a URL is enough to prevent authentication. I just get repeatedly asked to authenticate, round and round I go in a loop.

Can anyone shed any light on this please? I hope it's something I can fix via the config file but perhaps it's simply a limitation with the module itself?