Hi All,
I couldn’t get a clear answer from the
documentation. Based on the description of www_authenticate
and proxy_authenticate:
” The function verifies credentials
according to RFC2617. If the credentials are verified
successfully then the function will succeed and mark the
credentials as authorized (marked credentials can be later
used by some other functions). If the function was unable to
verify the credentials for some reason then it will fail and
the script should call www_challenge which will challenge the
user again.”
The RFC outlines basic and digest auth. Is
there a way to disable the ability for a UA to use basic auth?
Or maybe these is disabled already?
I’m likely understanding this wrong, it
seems to me that it’s allowed for a UA to auth with basic even
if the challenge is for digest. Any clarification would be
helpful.
Thanks!
-Skip