Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

The reason I would want to do this is to support very old browsers (e.g. IE 6) that does not implement the more secure Digest method. If all new clients advertise the types of authentication they support in the HTTP protocol, this should be doable in principle. If a client does not advertise that, Apache should fall back to the Basic auth scheme.

The advantage over using Basic auth is apparent: it would prevent passwords to travel in clear over the network most of the times, since the new browser are the majority, while still supporting some very old browsers that are still around. In other words, it would increase security.

share|improve this question
    
It's not the client that advertises support, but the server that presents the two challenges, where the browser is meant to reply with the "most secure" it can handle. In general, if you want security, use HTTPS (even with Basic authn). Digest is rarely used because it doesn't protect the request body (which could be tampered with). Often, it's better to go straight to HTTPS. A comment on SF seems to suggest only the last AuthType directive is taken into account. –  Bruno Apr 20 '12 at 10:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.