apache_2fa icon indicating copy to clipboard operation
apache_2fa copied to clipboard

AuthDigest not recommended for security reasons

Open AnAnalogGuy opened this issue 3 years ago • 0 comments

From the Apache http documentation regarding AuthDigest which is used as an example in this project's documentation:

This module implements HTTP Digest Authentication (RFC2617), and provides an alternative to mod_auth_basic where the password is not transmitted as cleartext. However, this does not lead to a significant security advantage over basic authentication. On the other hand, the password storage on the server is much less secure with digest authentication than with basic authentication. Therefore, using basic auth and encrypting the whole connection using mod_ssl is a much better alternative.

https://httpd.apache.org/docs/2.4/mod/mod_auth_digest.html

AnAnalogGuy avatar Mar 20 '22 14:03 AnAnalogGuy