Usar HTTP Digest Authentication
Digest Auth hashes credenciales con un servidor nonce, preventing contraseña exposure sin HTTPS. Aprender el challenge-respuesta flow y MD5 usage.
- 1
Digest Auth sends a challenge (nonce, realm) from the server. The client computes MD5(username:realm:password) and MD5(method:uri) and sends MD5(ha1:nonce:ha2). The server verifies by recomputing. The password is never sent in clear text, but MD5 is weak — Digest Auth is obsolete; use HTTPS + Bearer tokens instead.
- 2 Generador de HMAC →
Generar an HMAC for the digest computation. While Digest Auth uses MD5 (not HMAC), the concept is similar: a keyed hash of the message. HMAC is more secure — use it for modern authentication schemes.
- 3 Calculadora de hash →
Calcular the MD5 hash for Digest Auth components: HA1 = MD5(username:realm:password), HA2 = MD5(method:uri), response = MD5(HA1:nonce:HA2). Note: MD5 is cryptographically broken — use only for legacy Digest Auth compatibility, not for new systems.
Preguntas frecuentes
- ¿Es Digest Auth seguro?
- It is better than Basic Auth over HTTP (password is not sent in clear text), but it relies on MD5 which is broken. It does not protect against man-in-the-middle (MITM) attacks or provide confidentiality. Use HTTPS + Bearer tokens for modern authentication. Digest Auth is retained for legacy compatibility only.
- Why is Digest Auth obsolete?
- It requires storing HA1 (MD5 of password) on the server, which is vulnerable to rainbow table attacks. It does not support modern password hashing (bcrypt, scrypt). It is complex to implement correctly (nonce management, qop, opaque). HTTPS makes the password protection of Digest Auth redundant.