Re: Digest access authentication format
- From: yawnmoth <terra1024@xxxxxxxxx>
- Date: Sat, 19 Dec 2009 13:40:26 -0800 (PST)
On Dec 18, 11:32 pm, yawnmoth <terra1...@xxxxxxxxx> wrote:
From <http://tools.ietf.org/html/rfc2617#section-3.2.2>:
username = "username" "=" username-value
username-value = quoted-string
digest-uri = "uri" "=" digest-uri-value
digest-uri-value = request-uri ; As specified by HTTP/1.1
From a Wireshark capture of Digest access authentication:
Authorization: Digest username="test", realm="...",
nonce="AAR638Epy8c=89095bd24b74677157136987475f5b678ca33945", uri="/
path/to/test.php", algorithm=MD5,
response="44ace83593f6562119a38aef0c34b76a", qop=auth, nc=00000007,
cnonce="c4859daa492b97e6"
My question is... why does uri, in the Wireshark capture, have double
quotes? username has them because quoted-string (which is what
username-value is defined as) has them but request-uri (which is what
digest-uri-value is defined as), as defined in <http://tools.ietf.org/
html/rfc2616#section-5.1.2> does not appear to. So why are they there?
Related to this, <http://tools.ietf.org/html/rfc2069#section-2.1.2>'s
Authorization header has an optional parameter - digest. <http://
tools.ietf.org/html/rfc2617#section-3.2.2>, however, makes no mention
of a digest header. Why was the 'digest' header dropped? (note that I
haven't read all of RFC2617 yet so if it's explained further within
that I probably just haven't gotten to that part of it).
Also, what's the point of including an algorithm parameter in the
Authorization header? The domains parameter, as defined in the WWW-
Authorize header, isn't returned in the Authorization header because
presumably it'd serve no point. It seems to me that the algorithm
parameter is similarly pointless? And if the client can pick and
choose what algorithms it wants to use then why does the server send
the algorithm parameter in the WWW-Authorize header? It doesn't seem
to me that RFC2617 has any provisions for algorithm negotiation so
it's not as if the server can say "here's a list of algorithms I
support" and the client can pick among them.
.
- Follow-Ups:
- Re: Digest access authentication format
- From: Ilmari Karonen
- Re: Digest access authentication format
- References:
- Digest access authentication format
- From: yawnmoth
- Digest access authentication format
- Prev by Date: Re: Music as crypto medium
- Next by Date: Re: Diffie Hellman Question
- Previous by thread: Digest access authentication format
- Next by thread: Re: Digest access authentication format
- Index(es):
Relevant Pages
|
