Re: Digest Authentication

Hello, On 08/22/2002 10:53 PM, Seairth Jacobs wrote:

Anyway, if you are looking for a more browser independent message, you may want to try using forms based authentication using md5 to encrypt the passwords. It will require a Javascript enabled browser but that is more than 95% of the browsers.

The problem with this is that I am attempting to implement a RESTful webservice. I do not want to use PHP's session handling because it tries to do things that I do not want done (like sending cookies). In order to work within the REST principles, I also do not want alter my URLs by passing around a Session ID. As a result, my options are very limited, hence the HTTP Authentication scheme.

If you ask me, either your system will be secure and slow, insecure and fast or use cookies to have a compromise. You can use SSL or some authentication method for all accesses that need to authenticated or you can use basic authentication over HTTP. To avoid the problems you can the first method just for the first access and cache it in session cookies just validating the IP to avoid being even more insecure. Cookies are not a bad thing. I don't know your reasons but it seems that some people have a sort of irrational alergy to cookies as if they contain a sort of disease. -- Regards, Manuel Lemos