From b583514cfd68198b437e05813c71ca6227b06c81 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Igor=20Gali=C4=87?= Date: Sat, 1 Dec 2012 09:53:54 +0000 Subject: [PATCH] merge r1415960 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1415961 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_auth_digest.xml | 51 ++--------------------------- 1 file changed, 2 insertions(+), 49 deletions(-) diff --git a/docs/manual/mod/mod_auth_digest.xml b/docs/manual/mod/mod_auth_digest.xml index 1194318c0d..f558321615 100644 --- a/docs/manual/mod/mod_auth_digest.xml +++ b/docs/manual/mod/mod_auth_digest.xml @@ -71,60 +71,13 @@ Note

Digest authentication is more secure than Basic authentication, - but only works with supporting browsers. As of September 2004, major - browsers that support digest authentication include Amaya, Konqueror, MS Internet Explorer - for Mac OS X and Windows (although the Windows version fails when - used with a query string -- see "Working with MS - Internet Explorer" below for a workaround), Mozilla, - Netscape 7, Opera, and Safari. lynx does not - support digest authentication. Since digest authentication is not as - widely implemented as basic authentication, you should use it only - in environments where all users will have supporting browsers.

+ but only works with supporting browsers. As of this writing (December + 2012) all major browsers support digest authentication.

mod_auth_digest only works properly on platforms where APR supports shared memory.

-
Working with MS Internet Explorer -

The Digest authentication implementation in previous Internet - Explorer for Windows versions (5 and 6) had issues, namely that - GET requests with a query string were not RFC compliant. - There are a few ways to work around this issue.

- -

- The first way is to use POST requests instead of - GET requests to pass data to your program. This method - is the simplest approach if your application can work with this - limitation. -

- -

Since version 2.0.51 Apache also provides a workaround in the - AuthDigestEnableQueryStringHack environment variable. - If AuthDigestEnableQueryStringHack is set for the - request, Apache will take steps to work around the MSIE bug and - remove the query string from the digest comparison. Using this - method would look similar to the following.

- - Using Digest Authentication with MSIE: - - BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On - - - -

This workaround is not necessary for MSIE 7, though enabling it does - not cause any compatibility issues or significant overhead.

- -

See the BrowserMatch - directive for more details on conditionally setting environment - variables.

-
- AuthDigestProvider -- 2.40.0