apache_2fa
apache_2fa copied to clipboard
AuthDigest not recommended for security reasons
From the Apache http documentation regarding AuthDigest which is used as an example in this project's documentation:
This module implements HTTP Digest Authentication (RFC2617), and provides an alternative to mod_auth_basic where the password is not transmitted as cleartext. However, this does not lead to a significant security advantage over basic authentication. On the other hand, the password storage on the server is much less secure with digest authentication than with basic authentication. Therefore, using basic auth and encrypting the whole connection using mod_ssl is a much better alternative.
https://httpd.apache.org/docs/2.4/mod/mod_auth_digest.html