title: One time nonce http digest authentication
body: <p>I try to implement a one time none for HTTP digest authentication process. First of all I'm aware of the fact that the authentication is not perfectly secure. Please do not tell me to use something else. The authentication process is working as expected. When the user authenticate successfully I append a http Authentication-Info field with the next nonce. The browser in this case Firefox is not using this nonce for further requests.</p>
  <pre><code>Authentication-Info: nextnonce=&quot;06e8043d3fb8c26156829c4b55afd13040&quot;
  </code></pre>
  <p>Why is the browser not using my new nonce for future requests? It still uses the old now invalid one!</p>
  <p>RFC7616 describes the header field.
  <a href="https://www.rfc-editor.org/rfc/rfc7616#section-3.5" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc7616#section-3.5</a></p>
  <blockquote>
  <p>The value of the nextnonce parameter is the nonce the server
  wishes the client to use for a future authentication response.
  The server MAY send the Authentication-Info header field with a
  nextnonce field as a means of implementing one-time nonces or
  otherwise changing nonces.  If the nextnonce field is present, ...</p>
  </blockquote>
  <p>RFC2617 describes the syntax in section 3.2.3</p>
  <p><a href="https://www.ietf.org/rfc/rfc2617.txt" rel="nofollow noreferrer">https://www.ietf.org/rfc/rfc2617.txt</a></p>
  <p>[Edit]</p>
  <p>Is it possible that firefox is not supporting this feature. If I search here
  <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate" rel="nofollow noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate</a>
  for the header field I can't find a result.</p>
  <p>But it is listed as standard header flag here:
  <a href="https://www.iana.org/assignments/message-headers/message-headers.xhtml" rel="nofollow noreferrer">https://www.iana.org/assignments/message-headers/message-headers.xhtml</a></p>