3 ms·
For Digest the article says "Credentials must be sent with every request"... but not really. Once you're logged in the server can remember that you are and not
by ape4 6y ago
For Digest the article says "Credentials must be sent with every request"... but not really. Once you're logged in the server can remember that you are and not ask for it each time. The client can only send it when requested.
- mattmanser 6y agoPerhaps I am misunderstanding you, but you actually stay 'logged in' by sending an authentication token with each request, usually handled by a cookie in most web frameworks that is all handled for you. So you actually are sending some sort of credential every request.
- ape4 6y agoSorry I wasn't clear. With http/2 you establish a connection and then send multiple requests on it. So I wrote an implementation that just asks for the Digest auth the first request on the connection. The server doesn't issue another challenge until the next connection.
- rini17 6y agoI haven't seen such implementation in the wild. "To remember you are you" means switching to another authentication method which is needless complication.