3 ms·
It sends Base64 encoded passwords. So if you use http it is basically cleartext. You still don't need to store the passwords in cleartext, as you can use the
by pwim 16y ago
It sends Base64 encoded passwords. So if you use http it is basically cleartext. You still don't need to store the passwords in cleartext, as you can use the same hashing mechanisms you would with other login methods.
- joshu 16y agoI thought for digest auth, it the server sends a new nonce, and then asks for md5(md5(username:password):nonce:md5(something i forget)) - you couldn't verify that unless you had access to the raw password, no? summon @tpateck