Re: DIGEST-MD5 on HTTP webserver

On 1 Aug 2013, at 11:53, Nil Croustillac <[email protected]> wrote:

> I noticed that but I wonder how to use it on server side and by starting/releasing a new server at each request.
> I have seen the client example and it doesn't really help in my case.

If you don't preserve a SASL context between Digest authentication steps, then I don't think you can use Cyrus SASL's version as is.
> 
> I'll continue investigating but any help would be appreciated :)
> 
> 
> On Thu, Aug 1, 2013 at 11:42 AM, Alexey Melnikov <[email protected]> wrote:
>> Actually, Cyrus SASL now supports HTTP Digest via a flag.
>> 
>> Sent from my iPhone
>> 
>> On 1 Aug 2013, at 08:08, Phil Pennock <[email protected]> wrote:
>> 
>> > On 2013-07-31 at 17:07 +0200, Nil Croustillac wrote:
>> >> It's been a while now I am trying to implement the Digest authentication
>> >> with the Cyrus SASL library and I don't understand how to proceed.
>> >> I am using the version 2.1.25 and only support digest mechanism, here is
>> >> the desired behaviour (which doesn't work)
>> >
>> > HTTP does not use SASL as a framing layer.
>> >
>> > You want to read RFC 2617 which explains what goes into the headers at
>> > each step, and implement based on that.  There are definite similarities
>> > between HTTP Digest Authentication and DIGEST-MD5 as used in SASL, but a
>> > SASL library won't typically help with HTTP.
>> >
>> > You might try using libcurl instead?
>> >
>> > -Phil
>