What is HTTP Digest Authentication?

HTTP Digest authentication is intended to supersede unencrypted use of the Basic access authentication, allowing user identity to be established securely without having to send a password in plaintext over the network. Digest authentication is basically an application of MD5 cryptographic hashing with usage of nonce values to prevent cryptanalysis.

The process consists of the following steps

1. The client asks for a page that requires authentication but does not provide a username and password. Typically this is because the user simply entered the address or followed a link to the page.
2. The server responds with the "401" response code, providing the authentication realm and a randomly-generated, single-use value called a nonce.
3. At this point, the client will present the authentication realm (typically a description of the computer or system being accessed) to the user and prompt for a user name and password. The user may decide to cancel at this point.
4. Once a user name and password have been supplied, the client re-sends the same request but adds an authentication header that includes the response code.
5. In this example, the server accepts the authentication and the page is returned. If the user name is invalid and/or the password is incorrect, the server might return the "401" response code and the client would prompt the user again.

Note: A client may already have the required user name and password without needing to prompt the user, e.g. if they have previously been stored by a web browser