Do you still need to use digest authentication if you are on SSL?

Question

This is probably a dumb question but can I do away safely with just basic HTTP auth or do I still benefit from digest auth even if the server is already on SSL?

Conventioner

Answer 1

The only advantage you would gain by using HTTP Digest authentication over SSL/TLS is to prevent the disclosure of the user password to the server itself, if your sever is capable of being configured with passwords in "HA1 format" directly (i.e. if it doesn't need to know the password itself, but where the user password can be configured with MD5(username:realm:password), without requiring the password in clear, see Apache Httpd for example).

In practice, this isn't really a big advantage. There are better alternatives if protecting the password itself from the server is required (in particular because MD5 isn't considered good enough anyway nowadays).

The other features of HTTP Digest authentication (over form/HTTP Basic) are already provided by the SSL/TLS layer.

Exhibitionism

Note that as of 2015, Digest supports SHA-256 and SHA-512/256: tools.ietf.org/html/rfc7616#section-3.2 – Majordomo

Answer 2

Across ssl basic auth is secure enough for most needs.

Tigress