juanriaza/django-rest-framework-digestauth — pull request #6 by defrex (2014-01-30 22:35:03+00:00)
Title: This implementation is vulnerable to a replay attack

Right now this pull request is just a failing test to get a conversation started.

The `nc` value in the header is supposed to be a counter to prevent replay attacks. Every time the same client and server nonce pair is used, the nonce counter must be incremented by the client. This will cause a new hash to be generated for the response. In this way, a request can never be replayed.

Solving this problem involves keeping track of client state on the server. A new model is probably the most straightforward solution, but it will balloon with a speed similar to Django's session table. Alternately it could be stored using Django's cache mechanism, but if the cache is lost there would have to be a forced expiry of all the server nonces, which would cause every client to 401 for a request.

What do you think?