Verwenden HTTP Digest Authentication
Digest Auth hashes Anmeldedaten mit ein Server nonce, preventing Passwort exposure ohne HTTPS. Lernen der challenge-Antwort flow und MD5 usage.
- 1
Digest Auth sends a challenge (nonce, realm) from the server. The client computes MD5(username:realm:password) and MD5(method:uri) and sends MD5(ha1:nonce:ha2). The server verifies by recomputing. The password is never sent in clear text, but MD5 is weak — Digest Auth is obsolete; use HTTPS + Bearer tokens instead.
- 2 HMAC-Generator →
Erzeugen an HMAC for the digest computation. While Digest Auth uses MD5 (not HMAC), the concept is similar: a keyed hash of the message. HMAC is more secure — use it for modern authentication schemes.
- 3 Hash-Rechner →
Berechnen the MD5 hash for Digest Auth components: HA1 = MD5(username:realm:password), HA2 = MD5(method:uri), response = MD5(HA1:nonce:HA2). Note: MD5 is cryptographically broken — use only for legacy Digest Auth compatibility, not for new systems.
Häufige Fragen
- Ist Digest Auth sicher?
- It is better than Basic Auth over HTTP (password is not sent in clear text), but it relies on MD5 which is broken. It does not protect against man-in-the-middle (MITM) attacks or provide confidentiality. Use HTTPS + Bearer tokens for modern authentication. Digest Auth is retained for legacy compatibility only.
- Why is Digest Auth obsolete?
- It requires storing HA1 (MD5 of password) on the server, which is vulnerable to rainbow table attacks. It does not support modern password hashing (bcrypt, scrypt). It is complex to implement correctly (nonce management, qop, opaque). HTTPS makes the password protection of Digest Auth redundant.