I am developing a Web API that performs Digest authentication, but when I set the message digest algorithm to SHA-256, the client side seems to crash.
Is there something wrong with the server-side implementation?

Language: Java, Server: Tomcat7.0
OS: Windows 10 for both server and client

Digest authentication does not use tomcat's web.xml, server.xml, or tomcat-users.xml settings, but implements sending WWW-Authenticate header and receiving Authorization header in Servlet.
At this time, if MD5 is used as the algorithm of the digest, authentication will succeed, but if you change to SHA-256 because it is deprecated, the client side will not return the result after sending the WW-Authenticate header .

WWW-Authenticate: Digest realm = "example.com", qop = auth, nonce = "f5d6eeccc66664731c72e3300d3dfadf", opaque = "56b2ea6d037b522661a3719ec48b7d9a", algorithm = SHA-256

* Successful when algorithm = MD5

(In the case of browser)

An error occurs in Http status 401 without displaying the dialog for entering the user and password.
Looking at the communication status with the developer tools, it seems that WWW-Authenticate: is received, but it does not seem to generate Authorization header.

(curl command)

curl -v -k --digest --use r "user: password" "url"

After receiving the WWW-Authenticate header, curl exits with an out of memory message