From 534eaa3a626bb085174a115b902691565804edd3 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Igor=20Gali=C4=87?= Date: Sat, 1 Dec 2012 09:50:47 +0000 Subject: [PATCH] axe warnings about MSIE 5 and other dead browsers git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1415960 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_auth_digest.xml | 51 ++--------------------------- 1 file changed, 2 insertions(+), 49 deletions(-) diff --git a/docs/manual/mod/mod_auth_digest.xml b/docs/manual/mod/mod_auth_digest.xml index b10bfa2a051..df87588eba2 100644 --- a/docs/manual/mod/mod_auth_digest.xml +++ b/docs/manual/mod/mod_auth_digest.xml @@ -71,60 +71,13 @@ Note

Digest authentication is more secure than Basic authentication, - but only works with supporting browsers. As of September 2004, major - browsers that support digest authentication include Amaya, Konqueror, MS Internet Explorer - for Mac OS X and Windows (although the Windows version fails when - used with a query string -- see "Working with MS - Internet Explorer" below for a workaround), Mozilla, Netscape 7, - Opera, and Safari. lynx does not - support digest authentication. Since digest authentication is not as - widely implemented as basic authentication, you should use it only - in environments where all users will have supporting browsers.

+ but only works with supporting browsers. As of this writing (December + 2012) all major browsers support digest authentication.

mod_auth_digest only works properly on platforms where APR supports shared memory.

-
Working with MS Internet Explorer -

The Digest authentication implementation in previous Internet - Explorer for Windows versions (5 and 6) had issues, namely that - GET requests with a query string were not RFC compliant. - There are a few ways to work around this issue.

- -

- The first way is to use POST requests instead of - GET requests to pass data to your program. This method - is the simplest approach if your application can work with this - limitation. -

- -

Since version 2.0.51 Apache also provides a workaround in the - AuthDigestEnableQueryStringHack environment variable. - If AuthDigestEnableQueryStringHack is set for the - request, Apache will take steps to work around the MSIE bug and - remove the query string from the digest comparison. Using this - method would look similar to the following.

- - Using Digest Authentication with MSIE: - - BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On - - - -

This workaround is not necessary for MSIE 7, though enabling it does - not cause any compatibility issues or significant overhead.

- -

See the BrowserMatch - directive for more details on conditionally setting environment - variables.

-
- AuthDigestProvider -- 2.47.3