The reason I would want to do this is to support very old browsers (e.g. IE 6) that does not implement the more secure Digest method. If all new clients advertise the types of authentication they support in the HTTP protocol, this should be doable in principle. If a client does not advertise that, Apache should fall back to the Basic auth scheme.

The advantage over using Basic auth is apparent: it would prevent passwords to travel in clear over the network most of the times, since the new browser are the majority, while still supporting some very old browsers that are still around. In other words, it would increase security.

  • It's not the client that advertises support, but the server that presents the two challenges, where the browser is meant to reply with the "most secure" it can handle. In general, if you want security, use HTTPS (even with Basic authn). Digest is rarely used because it doesn't protect the request body (which could be tampered with). Often, it's better to go straight to HTTPS. A comment on SF seems to suggest only the last AuthType directive is taken into account. – Bruno Apr 20 '12 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.