every request. Note that expiring a server nonce immediately will not work, as the client would never get a chance to use it. The .htdigest file .htdigest is a flat-file used to store usernames, realm and passwords for digest authentication of Apache HTTP Server. The name of the file is given in the .htaccess configuration, and can be anything, but ".htdigest" is the canonical name. The file name starts with a dot, because most Unix-like operating systems consider any file that begins with dot to be hidden. This file is often maintained with the shell command "htdigest" which can add, and update users, and will properly encode the password for use. The "htdigest" command is found in the apache2-utils package on dpkg package management systems and the httpd-tools package on RPM package management systems. The syntax of the htdigest command: htdigest [ -c ] passwdfile realm username The format of the .htdigest file: user1:Realm:5ea41921c65387d904834f8403185412 user2:Realm:734418f1e487083dc153890208b79379 SIP digest authentication Session Initiation Protocol (SIP) uses basically the same digest authentication algorithm. It is specified by RFC 3261. Browser implementation Most browsers have substantially implemented the spec, some barring certain features such as auth-int checking or the MD5-sess algorithm. If the server requires that these optional features be handled, clients may not be able to authenticate (though note mod_auth_digest for Apache does not fully implement RFC 2617 either). Amaya Gecko-based: (not including auth-int) Mozilla Application Suite Mozilla Firefox Netscape 7+ iCab 3.0.3+ KHTML- and WebKit-based: (not including auth-int) iCab 4 Konqueror Google Chrome Safari Tasman-based: Internet Explorer for Mac Trident-based: Internet Explorer 5+ (not including auth-int) Presto-based: Opera Opera Mobile Opera Mini Nintendo DS Browser Nokia 770 Browser Sony Mylo 1's Browser Wii Internet Channel Browser Deprecations Because of the disadvantages of Digest authentication compared to Basic authentication over HTTPS it has been deprecated by a lot of software e.g.: Bitbucket: https://bitbucket.org/blog/fare-thee-well-digest-access-authentication Symfony PHP framework: https://github.com/symfony/symfony/issues/24325 See also AKA (security) JSON Web Token (JWT) Basic access authentication HTTP+HTML form-based authentication Notes References External links RFC 7235 RFC 2617 (updated by RFC 7235) RFC 2069 (obsolete) Cryptographic protocols Hypertext Transfer Protocol Request for Comments Computer access control protocols de:HTTP-Authentifizierung#Digest Access Authentication fr:HTTP Authentification#Méthode Digest