Enable support for Digest Authentication

[snej]

We really shouldn't allow clients to authenticate using Basic auth over a non-SSL connection, since it leaks the user's credentials. (If this weren't so common, it would be considered a horrible security vulnerability.)

We do probably still need to support some sort of username/password auth for non-SSL, which means Digest auth (I don't know of any comparable alternatives.) Go's HTTP package doesn't support it, but there is a go-http-auth package that does and seems to be pretty easy to adopt.

[snej]

Note: iOS's ChangeTracker doesn't support Digest auth, but I'm in the middle of fixing that.

[adamcfraser]

Can SG support digest when it's storing passwords using bcrypt? I didn't think we had the ability to extract the password to build the MD5 hash for digest. Or is there a way around this?

[snej]

That's a good point. If we were storing a MD5 or SHA digest of the password I think it would work (the server-side part of Digest auth doesn't actually require the password itself, just a digest) but not with something funky like jillions of rounds of bcrypt hashing.

[snej]

From section 4.13 of the RFC:

   Digest authentication requires that the authenticating agent (usually
   the server) store some data derived from the user's name and password
   in a "password file" associated with a given realm. Normally this
   might contain pairs consisting of username and H(A1), where H(A1) is
   the digested value of the username, realm, and password as described
   above.
   The security implications of this are that if this password file is
   compromised, then an attacker gains immediate access to documents on
   the server using this realm. Unlike, say a standard UNIX password
   file, this information need not be decrypted in order to access
   documents in the server realm associated with this file.
   ... [T]he password file must be protected as if it contained unencrypted
   passwords, because for the purpose of accessing documents in its
   realm, it effectively does.

[tleyden]

I think we would should add a property like allow_basic_auth_non_ssl which defaults to false. Users can override it if they need to (for local testing).

[adamcfraser]

Closing this ticket, as JWT would be the preferred alternative to basic auth in non-SSL scenarios.