topic
Verified 2026-09-18Digest Authentication
Digest authentication proves knowledge of a password through a challenge-response exchange instead of sending the password directly.
Digest reduces password exposure on the wire but is not a modern replacement for TLS, has complex nonce and algorithm rules, and should be selected only when interoperability requires it.
httpauthsecurityauthenticationlegacy
Reference (http)
WWW-Authenticate: Digest realm="api", nonce="...", algorithm=SHA-256, qop="auth" Authorization: Digest username="alice", realm="api", nonce="...", uri="/me", response="..."
Digest reduces password exposure on the wire but is not a modern replacement for TLS, has complex nonce and algorithm rules, and should be selected only when interoperability requires it.
Common mistakes
- Treating Digest as password encryption, accepting stale or reused nonces, or omitting TLS because the password is not sent verbatim.