security - Is the client allowed to choose challenge (nonce) in Digest HTTP authentication? -
digest authentication looks flavor of challenge-response mechanism: theres's random string mixed password (md5 or something) both client , server , result of such mixing sent on network.
usually challenge ("nonce") chosen server , sent client. wikipedia article on digest authentication lists sample "session" - challenge ("nonce") chosen server there. tested same iis on machine - again, challenge generated iis.
but in posts like one challenge generated client - client generates random string , sends request challenge , product of password , challenge.
is latter allowed , accepted? client allowed choose challenge ("nonce")?
in http digest authentication, server generates nonce.
however, http authentication extensible, , applications may implement other methods of authentication (beyond basic , digest). in example link to, client authenticating using wsse, form of authentication (mainly soap-based) web services. in wsse, client generates nonce.
Comments
Post a Comment