This library implements HTTP Digest Authentication as per RFC2617. Unlike Basic Authentication, digest authentication is based on challenge-reponse and therefore does not need to send the password over the (insecure) connection. In addition, it provides a count mechanism that ensure that old credentials cannot be reused, which prevents attackers from using old credentials with a new request. Digest authentication have the following advantages and disadvantages:
And, of course, the connection itself remains insecure. Digest based authentication is a viable alternative if HTTPS is not a good option and security of the data itself is not an issue.
This library acts as plugin for
where the registered handler (http_handler/3)
can be given the option below to initiate digest authentication.
Above, PasswdFile is a file containing lines of the from
below, where PasswordHash is computed using http_digest_password_hash/4.
User ":" PasswordHash (":" Extra)*
This library also hooks into
authorization(digest(User, Password)) is given.
WWW-Authenticate: Digestheader field.
WWW-Authenticateheader into a list of Name(Value) terms.
|Challenge||is a list Name(Value), normally
|User||is the user we want to authenticated|
|Password||is the user's password|
|Options||provides additional options|
The inexpensive MD5 algorithm makes the hash sensitive to brute force attacks while the lack of seeding make the hashes sensitive for rainbow table attacks, although the value is somewhat limited because the realm and user are part of the hash.
library(http_dispatch)to perform basic HTTP authentication. Note that we keep the authentication details cached to avoid a `nonce-replay' error in the case that the application tries to verify multiple times.
This predicate throws
|Digest||is a term |
|Request||is the HTTP request|
|Fields||describes the authenticated user with
authorization(AuthData)and Out is a stream on which to write additional HTTP headers.
request_header(authorization=Digest)header to Options, causing http_open/3 to retry the request with the additional option.