SEC-1905: DigestAuthenticationFilter documentation is misleading #2136

spring-issuemaster opened this Issue Jan 31, 2012 · 1 comment


None yet
2 participants

Bruce (Migrated from SEC-1905) said:

Section 10.2.1 states "The configured UserDetailsService is needed because DigestAuthenticationFilter must have direct access to the clear text password of a user. Digest Authentication will NOT work if you are using encoded passwords in your DAO"

This is a bit misleading.

The Password just needs to be hashed as MD5(username:realm:password) and then the filter must have the passwordAlreadEncoded attribute
set to true. Care must be taken to ensure that the realm for the DigestAuthenticationEntryPoint is set to the same value that is used by the MD5 Hash.

The hash can be easily found with
String DigestAuthUtils.encodePasswordInA1Format(String username, String realm, String password)
In the package.

Rob Winch said:

I have added a footnote that clarifies this point.

spring-issuemaster added this to the 3.1.2 milestone Feb 5, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment