From b583514cfd68198b437e05813c71ca6227b06c81 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Igor=20Gali=C4=87?= Digest authentication is more secure than Basic authentication,
- but only works with supporting browsers. As of September 2004, major
- browsers that support digest authentication include Amaya, Konqueror, MS Internet Explorer
- for Mac OS X and Windows (although the Windows version fails when
- used with a query string -- see "Working with MS
- Internet Explorer" below for a workaround), Mozilla,
- Netscape 7, Opera, and Safari. lynx does not
- support digest authentication. Since digest authentication is not as
- widely implemented as basic authentication, you should use it only
- in environments where all users will have supporting browsers.
The Digest authentication implementation in previous Internet
- Explorer for Windows versions (5 and 6) had issues, namely that
- GET
requests with a query string were not RFC compliant.
- There are a few ways to work around this issue.
- The first way is to use POST
requests instead of
- GET
requests to pass data to your program. This method
- is the simplest approach if your application can work with this
- limitation.
-
Since version 2.0.51 Apache also provides a workaround in the
- AuthDigestEnableQueryStringHack
environment variable.
- If AuthDigestEnableQueryStringHack
is set for the
- request, Apache will take steps to work around the MSIE bug and
- remove the query string from the digest comparison. Using this
- method would look similar to the following.
This workaround is not necessary for MSIE 7, though enabling it does - not cause any compatibility issues or significant overhead.
- -See the