In addition to Digest authentication with username/password, libmicrohttpd also supports Digest authentication using username/HA1 hash and variations using different hashing algorithms. HA1 = hash_function(username:realm:password). Storing the HA1 hash instead of passwords offers user privacy and some additional security since they are not reversible.
Namely:
1.
int MHD_digest_auth_check_digest (struct MHD_Connection *connection, const char *realm, const char *username, const unsigned char digest[MHD_MD5_DIGEST_SIZE], unsigned int nonce_timeout)
2.
int MHD_digest_auth_check_digest2 (struct MHD_Connection *connection, const char *realm, const char *username, const uint8_t *digest, unsigned int nonce_timeout, enum MHD_DigestAuthAlgorithm algo)
Relevant code locations in libhttpserver:
http_request.hpp:206 declaration of http_request::check_digest_auth()
http_request.cpp:47 contains http_request::check_digest_auth() which uses MHD_digest_auth_check()
Proposal:
Add http_request::check_digest_auth_digest() which is identical to check_digest_auth except for using MHD_digest_auth_check_digest and replacing const std::string& password with either const unsigned digest[MHD_MD5_DIGEST_SIZE] or even better const std::array<unsigned char, MHD_MD5_DIGEST_SIZE> digest just to ensure that the pointer actually refers to a memory block of the right size.
I meant to create a pull request (actually, I still do), but haven't had the time to properly test it myself yet (generally testing on Debian7 (32bit / gcc4.9), Debian9 (gcc6.3), Ubuntu 20.04 (gcc9.3 + gcc10.2)) and I don't think I will have the time in the next month at the very least. Ideally, I would like libhttpserver to support all four MHD_digest_auth_check...() functions.
In addition to Digest authentication with username/password, libmicrohttpd also supports Digest authentication using username/HA1 hash and variations using different hashing algorithms. HA1 = hash_function(username:realm:password). Storing the HA1 hash instead of passwords offers user privacy and some additional security since they are not reversible.
Namely:
1.
int MHD_digest_auth_check_digest (struct MHD_Connection *connection, const char *realm, const char *username, const unsigned char digest[MHD_MD5_DIGEST_SIZE], unsigned int nonce_timeout)2.
int MHD_digest_auth_check_digest2 (struct MHD_Connection *connection, const char *realm, const char *username, const uint8_t *digest, unsigned int nonce_timeout, enum MHD_DigestAuthAlgorithm algo)Relevant code locations in libhttpserver:
http_request.hpp:206declaration ofhttp_request::check_digest_auth()http_request.cpp:47containshttp_request::check_digest_auth()which usesMHD_digest_auth_check()Proposal:
Add
http_request::check_digest_auth_digest()which is identical tocheck_digest_authexcept for usingMHD_digest_auth_check_digestand replacingconst std::string& passwordwith eitherconst unsigned digest[MHD_MD5_DIGEST_SIZE]or even betterconst std::array<unsigned char, MHD_MD5_DIGEST_SIZE> digestjust to ensure that the pointer actually refers to a memory block of the right size.I meant to create a pull request (actually, I still do), but haven't had the time to properly test it myself yet (generally testing on Debian7 (32bit / gcc4.9), Debian9 (gcc6.3), Ubuntu 20.04 (gcc9.3 + gcc10.2)) and I don't think I will have the time in the next month at the very least. Ideally, I would like libhttpserver to support all four
MHD_digest_auth_check...()functions.