samizdatco/ngx-http-auth-digest — Issue #3: Requires qop-base authentication
Author: samizdatco
Created: 2011-11-04 23:43:16+00:00
State: open

the module currently lacks backward compatibility with clients that don't provide ‘qop’ fields in the Authorize header. according to the RFC the server should work without it, but is it worth supporting the less secure version of an already not-bulletproof authentication scheme?