security - Is the client allowed to choose challenge (nonce) in Digest HTTP authentication? -


digest authentication looks flavor of challenge-response mechanism: theres's random string mixed password (md5 or something) both client , server , result of such mixing sent on network.

usually challenge ("nonce") chosen server , sent client. wikipedia article on digest authentication lists sample "session" - challenge ("nonce") chosen server there. tested same iis on machine - again, challenge generated iis.

but in posts like one challenge generated client - client generates random string , sends request challenge , product of password , challenge.

is latter allowed , accepted? client allowed choose challenge ("nonce")?

in http digest authentication, server generates nonce.

however, http authentication extensible, , applications may implement other methods of authentication (beyond basic , digest). in example link to, client authenticating using wsse, form of authentication (mainly soap-based) web services. in wsse, client generates nonce.


Comments

Popular posts from this blog

python - Scipy curvefit RuntimeError:Optimal parameters not found: Number of calls to function has reached maxfev = 1000 -

c# - How to add a new treeview at the selected node? -

java - netbeans "Please wait - classpath scanning in progress..." -