You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Support for MHD_digest_auth_check_digest(...) #221
In addition to Digest authentication with username/password, libmicrohttpd also supports Digest authentication using username/HA1 hash and variations using different hashing algorithms. HA1 = hash_function(username:realm:password). Storing the HA1 hash instead of passwords offers user privacy and some additional security since they are not reversible.
Relevant code locations in libhttpserver: http_request.hpp:206 declaration of http_request::check_digest_auth() http_request.cpp:47 contains http_request::check_digest_auth() which uses MHD_digest_auth_check()
Proposal:
Add http_request::check_digest_auth_digest() which is identical to check_digest_auth except for using MHD_digest_auth_check_digest and replacing const std::string& password with either const unsigned digest[MHD_MD5_DIGEST_SIZE] or even better const std::array<unsigned char, MHD_MD5_DIGEST_SIZE> digest just to ensure that the pointer actually refers to a memory block of the right size.
I meant to create a pull request (actually, I still do), but haven't had the time to properly test it myself yet (generally testing on Debian7 (32bit / gcc4.9), Debian9 (gcc6.3), Ubuntu 20.04 (gcc9.3 + gcc10.2)) and I don't think I will have the time in the next month at the very least. Ideally, I would like libhttpserver to support all four MHD_digest_auth_check...() functions.
Implemented in PR #360 (feature/digest-auth-ha1 branch). Added check_digest_auth_ha1() method supporting both MD5 and SHA256 algorithms via MHD_digest_auth_check_digest2(), plus algorithm specification in digest_auth_fail_response for server-driven algorithm selection.
Activity
etr commentedon Jan 30, 2026
Implemented in PR #360 (feature/digest-auth-ha1 branch). Added check_digest_auth_ha1() method supporting both MD5 and SHA256 algorithms via MHD_digest_auth_check_digest2(), plus algorithm specification in digest_auth_fail_response for server-driven algorithm selection.