From: Igor Galić Date: Sat, 1 Dec 2012 09:50:47 +0000 (+0000) Subject: axe warnings about MSIE 5 and other dead browsers X-Git-Tag: 2.5.0-alpha~6076 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cee74c48a55983338e89758641ed523205c2a763;p=thirdparty%2Fapache%2Fhttpd.git axe warnings about MSIE 5 and other dead browsers git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1415960 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_auth_digest.xml b/docs/manual/mod/mod_auth_digest.xml index b10bfa2a051..df87588eba2 100644 --- a/docs/manual/mod/mod_auth_digest.xml +++ b/docs/manual/mod/mod_auth_digest.xml @@ -71,60 +71,13 @@ Note

Digest authentication is more secure than Basic authentication, - but only works with supporting browsers. As of September 2004, major - browsers that support digest authentication include Amaya, Konqueror, MS Internet Explorer - for Mac OS X and Windows (although the Windows version fails when - used with a query string -- see "Working with MS - Internet Explorer" below for a workaround), Mozilla, Netscape 7, - Opera, and Safari. lynx does not - support digest authentication. Since digest authentication is not as - widely implemented as basic authentication, you should use it only - in environments where all users will have supporting browsers.

+ but only works with supporting browsers. As of this writing (December + 2012) all major browsers support digest authentication.

mod_auth_digest only works properly on platforms where APR supports shared memory.

-
Working with MS Internet Explorer -

The Digest authentication implementation in previous Internet - Explorer for Windows versions (5 and 6) had issues, namely that - GET requests with a query string were not RFC compliant. - There are a few ways to work around this issue.

- -

- The first way is to use POST requests instead of - GET requests to pass data to your program. This method - is the simplest approach if your application can work with this - limitation. -

- -

Since version 2.0.51 Apache also provides a workaround in the - AuthDigestEnableQueryStringHack environment variable. - If AuthDigestEnableQueryStringHack is set for the - request, Apache will take steps to work around the MSIE bug and - remove the query string from the digest comparison. Using this - method would look similar to the following.

- - Using Digest Authentication with MSIE: - - BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On - - - -

This workaround is not necessary for MSIE 7, though enabling it does - not cause any compatibility issues or significant overhead.

- -

See the BrowserMatch - directive for more details on conditionally setting environment - variables.

-
- AuthDigestProvider