- Documentation
- Reference manual
- Packages
- SWI-Prolog HTTP support
- The HTTP server libraries
- Creating an HTTP reply
- library(http/http_dispatch): Dispatch requests in the HTTP server
- library(http/http_dirindex): HTTP directory listings
- library(http/http_files): Serve plain files from a hierarchy
- library(http/http_session): HTTP Session management
- library(http/http_cors): Enable CORS: Cross-Origin Resource Sharing
- library(http/http_authenticate): Authenticate HTTP connections using 401 headers
- library(http/http_digest): HTTP Digest authentication
- library(http/http_dyn_workers): Dynamically schedule HTTP workers.
- Custom Error Pages
- library(http/http_openid): OpenID consumer and server library
- Get parameters from HTML forms
- Request format
- Running the server
- The wrapper library
- library(http/http_host): Obtain public server location
- library(http/http_log): HTTP Logging module
- library(http/http_server_health): HTTP Server health statistics
- Debugging HTTP servers
- library(http/http_header): Handling HTTP headers
- The library(http/html_write) library
- library(http/js_write): Utilities for including JavaScript
- library(http/http_path): Abstract specification of HTTP server locations
- library(http/html_head): Automatic inclusion of CSS and scripts links
- library(http/http_pwp): Serve PWP pages through the HTTP server
- The HTTP server libraries
- SWI-Prolog HTTP support
3.8 library(http/http_digest): HTTP Digest authentication
This library implements HTTP Digest Authentication as per RFC2617. Unlike Basic Authentication, digest authentication is based on challenge-reponse and therefore does not need to send the password over the (insecure) connection. In addition, it provides a count mechanism that ensure that old credentials cannot be reused, which prevents attackers from using old credentials with a new request. Digest authentication have the following advantages and disadvantages:
- Advantages
- Authentication without exchanging the password
- No re-use of authentication data
- Disadvantages
- An extra round trip is needed for the first authentication
- Server-side storage of the password is the MD5 hash of the user, realm and password. As MD5 hashes are quick to compute, one needs strong passwords. This fixed algorithm also allows for rainbow table attacks, although their value is limited because you need to precompute the rainbow table for every server (realm) and user.
- The connection is sensitive to man-in-the-middle attack, where the attacker can both change the request and response.
- Both client and server need to keep an administration of issued nonce values and associated nonce count values.
And, of course, the connection itself remains insecure. Digest based authentication is a viable alternative if HTTPS is not a good option and security of the data itself is not an issue.
This library acts as plugin for library(http/http_dispatch)
,
where the registered handler (http_handler/3)
can be given the option below to initiate digest authentication.
authentication(digest(PasswdFile, Realm))
Above, PasswdFile is a file containing lines of the from
below, where PasswordHash is computed using http_digest_password_hash/4.
See also
library(http/http_authenticate)
, http_read_passwd_file/2
and
http_write_passwd_file/2.
User ":" PasswordHash (":" Extra)*
This library also hooks into library(http/http_open)
if
the option
authorization(digest(User, Password))
is given.
- http_digest_challenge(+Realm,
+Options)
//
- Generate the content for a 401
WWW-Authenticate: Digest
header field. - [det]http_parse_digest_challenge(+Challenge, -Fields)
- Parse the value of an HTTP
WWW-Authenticate
header into a list of Name(Value) terms. - http_digest_response(+Challenge, +User, +Password, -Reply, +Options)
- Formulate a reply to a digest authentication request. Options:
- path(+Path)
- The request URI send along with the authentication. Defaults to
/
- method(+Method)
- The HTTP method. Defaults to
'GET'
- nc(+Integer)
- The nonce-count as an integer. This is formatted as an 8 hex-digit string.
Challenge is a list Name(Value), normally from http_parse_digest_challenge/2. Must contain realm
andnonce
. Optionally containsopaque
.User is the user we want to authenticated Password is the user's password Options provides additional options - [det]http_digest_password_hash(+User, +Realm, +Password, -Hash)
- Compute the password hash for the HTTP password file. Note that the HTTP
digest mechanism does allow us to use a seeded expensive arbitrary hash
function. Instead, the hash is defined as the MD5 of the following
components:
<user>:<realm>:<password>.
The inexpensive MD5 algorithm makes the hash sensitive to brute force attacks while the lack of seeding make the hashes sensitive for rainbow table attacks, although the value is somewhat limited because the realm and user are part of the hash.
- [multifile]http:authenticate(+Digest, +Request, -Fields)
- Plugin for
library(http_dispatch)
to perform basic HTTP authentication. Note that we keep the authentication details cached to avoid a‘nonce-replay’error in the case that the application tries to verify multiple times.This predicate throws
http_reply(authorise(digest(Digest)))
Digest is a term digest(File, Realm, Options)
Request is the HTTP request Fields describes the authenticated user with the option user(User)
and with the optionuser_details(Fields)
if the password file contains additional fields after the user and password. - [semidet,multifile]http:authenticate_client(+URL, +Action)
- This hooks is called by http_open/3
with the following Action value:
- send_auth_header(+AuthData, +Out, +Options)
- Called when sending the initial request. AuthData contains
the value for the http_open/3
option
authorization(AuthData)
and Out is a stream on which to write additional HTTP headers. - auth_reponse(+Headers, +OptionsIn, -Options)
- Called if the server replies with a 401 code, challenging the client.
Our implementation adds a
request_header(authorization=Digest)
header to Options, causing http_open/3 to retry the request with the additional option.