Digest authentication

Ktor supports HTTP digest authentication.It works differently than the basic/form auths:

  1. authentication {
  2.     digest {
  3.         val password = "Circle Of Life"
  4.         digester = MessageDigest.getInstance("MD5")
  5.         realm = "testrealm@host.com"
  6.         userNameRealmPasswordDigestProvider = { userName, realm ->
  7.             when (userName) {
  8.                 "missing" -> null
  9.                 else -> {
  10.                     digester.reset()
  11.                     digester.update("$userName:$realm:$password".toByteArray())
  12.                     digester.digest()
  13.                 }
  14.             }
  15.         }
  16.     }
  17. }

Instead of providing a verifier, you have to provide a userNameRealmPasswordDigestProvider that is in charge ofreturning the HA1 part of the digest. In the case of MD5: MD5("$username:$realm:$password").The idea is that you can store passwords already hashed.And only return the expected hash for a specific user, or null if the user does not exist.The callback is suspendable, so you can retrieve or compute the expected hash asynchronously,for example from disk or a database.

  1. authentication {
  2.     val myRealm = "MyRealm"
  3.     val usersInMyRealmToHA1: Map<String, ByteArray> = mapOf(
  4.         // pass="test", HA1=MD5("test:MyRealm:pass")="fb12475e62dedc5c2744d98eb73b8877"
  5.         "test" to hex("fb12475e62dedc5c2744d98eb73b8877")
  6.     )
  8.     digest("auth") {
  9.         userNameRealmPasswordDigestProvider = { userName, realm ->
  10.             usersInMyRealmToHA1[userName]
  11.         }
  12.     }
  13. }

HA1 (H(A1)) comes from RFC 2069 (An Extension to HTTP: Digest Access Authentication)

  1. HA1=MD5(username:realm:password) <-- You usually store this.
  2. HA2=MD5(method:digestURI)
  3. response=MD5(HA1:nonce:HA2) <-- The client and the server sends and checks this.

While realm is guaranteed to be the realm passed to the digestAuthentication function and it is passed just for convenience,userName can be any value, so take this into account and remember to escape and or validate it, when using that valuefor accessing the file system, accessing databases, storing it, generating HTML, etc.