Quantcast
Channel: Why doesn't form based authentication use digest instead of plain text - Information Security Stack Exchange
Viewing all articles
Browse latest Browse all 3

Answer by Steffen Ullrich for Why doesn't form based authentication use digest instead of plain text

$
0
0

Why doesn't the form based authentication on web browsers use the digest scheme instead?

A HTML form by itself is no form of authentication at all but it simply is collecting data entered by the user and submitting it to the server. If the server then uses these data for authentication is up to the server. Contrary to this HTTP Basic Authentication and HTTP Digest Authentication are specifically designed for authentication.

It is still possible to implement the kind of Challenge-Response authentication Digest authentication provides using Javascript and there are systems which do it. For example the Fritz!Box router used (and maybe still uses) such a form of authentication even though it uses a HTML form to enter the password.

Or is it so the digest challenge wouldn't provide any additional security over the form based authentication which requires TLS anyway?

Form based authentication does not require TLS at all. But it is clearly recommended to do it and many browsers warn today when submitting passwords using plain HTTP.

Using Digest authentication over HTTPS has no advantage in most cases compared to using Basic authentication or HTML forms where the password is transmitted in plain text. Contrary, Digest authentication requires that the password or some password equivalent is stored at the server in plain, which increases the risk of password or identity compromise if the server got compromised.See also HTTP Digest Authentication: Does the server store plaintext passwords?.

Digest authentication might make sense if the authentication is not done directly at the server but that the server itself forwards the credentials to some other authentication system, for example a RADIUS server. In this scenario Digest authentication has the advantage that the web application itself never gets access to the plain password.


Viewing all articles
Browse latest Browse all 3

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>