From what I understand proxies use a similar challenge/response system for authentication as HTTP does, except with a 407 response code where HTTP returns a 401 response code.

However if a client is configured to use a proxy and the authentication is setup correctly, does it need* to do the challenge/response actions? Can it not just send the hash in the first request to the proxy and be authenticated?


*Need refers to needing to correct in terms of the RFC spec (which I am not sure which one covers proxy)

link|improve this question

feedback

1 Answer

up vote 1 down vote accepted

For Digest authentication, I don't think this is possible.

As per RFC 2617, the Digest authentication is based on a challenge/response base on a nonce value sent by the server. As the server tracks the nonce and cnonce values, client has to receive a nonce value before authenticating.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.