More on Passwords - Apache

Instead of using htpasswd to create the passwords file, we need to use htdigest.  The creation of a username and password can be achieved with the following command (again in a command prompt set to the Apache bin directory):

htdigest -c C:hidden.digestpasswords "More Secure Protected Area" AuthUser

This time, the username, AuthName and the password are stored.  Again the password is encrypted using md5.  There is now no warning of basic security in the username and password prompt:

There is one more thing that Apache advises us to add when using the digest method of authentication. Because the digest method is still classed as experimental, there are flaws in the way that different browsers handle it.  There is a known issue with Internet Explorer whereby GET requests with a query string are not RFC compliant.  In order to allow Apache to work around this issue, it is recommended that the following conditional environment variable be used:

BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On

Just place this in the <Directory> section containing the digest directives.

SSL would be the next logical step in making connections to Apache even more secure, but unfortunately it is outside of the scope of this article.  The Apache documentation provides a wealth of further reading and information, but I hope this article has given you a practical and interesting introduction to the two methods of authentication available to you as an administrator of Apache.