{"id":51124497,"url":"https://github.com/atomx/nginx-http-auth-digest","last_synced_at":"2026-06-25T06:01:26.745Z","repository":{"id":20507124,"uuid":"23785701","full_name":"atomx/nginx-http-auth-digest","owner":"atomx","description":"Digest Authentication for Nginx","archived":false,"fork":true,"pushed_at":"2021-10-16T16:16:36.000Z","size":116,"stargazers_count":45,"open_issues_count":7,"forks_count":16,"subscribers_count":10,"default_branch":"master","last_synced_at":"2026-02-05T13:57:04.324Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"fukusaka/nginx-http-auth-digest","license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/atomx.png","metadata":{"files":{"readme":"readme.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-09-08T09:45:13.000Z","updated_at":"2025-03-12T14:06:55.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/atomx/nginx-http-auth-digest","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/atomx/nginx-http-auth-digest","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/atomx%2Fnginx-http-auth-digest","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/atomx%2Fnginx-http-auth-digest/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/atomx%2Fnginx-http-auth-digest/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/atomx%2Fnginx-http-auth-digest/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/atomx","download_url":"https://codeload.github.com/atomx/nginx-http-auth-digest/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/atomx%2Fnginx-http-auth-digest/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34761847,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-25T02:00:05.521Z","response_time":101,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-25T06:01:23.870Z","updated_at":"2026-06-25T06:01:26.740Z","avatar_url":"https://github.com/atomx.png","language":"C","funding_links":[],"categories":["Authentication"],"sub_categories":[],"readme":"==================================\nNginx Digest Authentication module\n==================================\n\nChanges from other forks\n========================\nBug fixes\n`1 \u003chttps://github.com/samizdatco/nginx-http-auth-digest/commit/9d77dcc58420d5afb8aa5a8138b1bf22a1933dd6\u003e`_, \n`2 \u003chttps://github.com/samizdatco/nginx-http-auth-digest/commit/b98725d3d0506c895f6a9f9d38f9168d499275fc\u003e`_,\n`3 \u003chttps://github.com/samizdatco/nginx-http-auth-digest/commit/47d5bac13cf071b4dbe81048b0f12a742ba512ae\u003e`_\n\n`Added log message for invalid login attempts \u003chttps://github.com/samizdatco/nginx-http-auth-digest/commit/9a402045082291c1f2f0a432ac24475277e2d176\u003e`_\n\nDescription\n===========\nThe ``ngx_http_auth_digest`` module supplements Nginx_'s built-in Basic Authentication `module`_ by providing support for `RFC`_ 2617 `Digest Authentication`_. The module is currently functional but has only been tested and reviewed by its author. And given that this is security code, one set of eyes is almost certainly insufficient to guarantee that it's 100% correct. Until a few bug reports come in and some of the ‘unknown unknowns’ in the code are flushed out, consider this module an ‘alpha’ and treat it with the appropriate amount of skepticism.\n\nA listing of known issues with the module can be found in the ``bugs.txt`` file as well as in the `Issue Tracker`_. Please do consider contributing a patch if you have the time and inclination. Any help fixing the bugs or changing the implementation to a more idiomatically nginx-y one would be greatly appreciated.\n\nDependencies\n============\n* Sources for Nginx_ 1.0.x, and its dependencies.\n\n\nBuilding\n========\n\n1. Unpack the Nginx_ sources::\n\n    $ tar zxvf nginx-1.0.x.tar.gz\n\n2. Unpack the sources for the digest module::\n\n    $ tar xzvf samizdatco-nginx-http-auth-digest-xxxxxxx.tar.gz\n\n3. Change to the directory which contains the Nginx_ sources, run the\n   configuration script with the desired options and be sure to put an\n   ``--add-module`` flag pointing to the directory which contains the source\n   of the digest module::\n\n    $ cd nginx-1.0.x\n    $ ./configure --add-module=../samizdatco-nginx-http-auth-digest-xxxxxxx  [other configure options]\n\n4. Build and install the software::\n\n    $ make \u0026\u0026 sudo make install\n\n5. Configure Nginx_ using the module's configuration directives_.\n\n\nExample\n=======\n\nYou can password-protect a directory tree by adding the following lines into\na ``server`` section in your Nginx_ configuration file::\n\n  auth_digest_user_file /opt/httpd/conf/passwd.digest; # a file created with htdigest\n  location /private{\n    auth_digest 'this is not for you'; # set the realm for this location block\n  }\n\n\nThe other directives control the lifespan defaults for the authentication session. The \nfollowing is equivalent to the previous example but demonstrates all the directives::\n\n  auth_digest_user_file /opt/httpd/conf/passwd.digest;\n  auth_digest_shm_size 4m;   # the storage space allocated for tracking active sessions\n\n  location /private {\n    auth_digest 'this is not for you';\n    auth_digest_timeout 60s; # allow users to wait 1 minute between receiving the\n                             # challenge and hitting send in the browser dialog box\n    auth_digest_expires 10s; # after a successful challenge/response, let the client\n                             # continue to use the same nonce for additional requests\n                             # for 10 seconds before generating a new challenge\n    auth_digest_replays 20;  # also generate a new challenge if the client uses the\n                             # same nonce more than 20 times before the expire time limit\n  }\n\nAdding digest authentication to a location will affect any uris that match that block. To\ndisable authentication for specific sub-branches off a uri, set ``auth_digest`` to ``off``::\n\n  location / {\n    auth_digest 'this is not for you';\n    location /pub {\n      auth_digest off; # this sub-tree will be accessible without authentication\n    }\n  }\n\nDirectives\n==========\n\nauth_digest\n~~~~~~~~~~~\n:Syntax:  ``auth_digest`` [*realm-name* | ``off``]\n:Default: ``off``\n:Context: server, location\n:Description:\n  Enable or disable digest authentication for a server or location block. The realm name\n  should correspond to a realm used in the user file. Any user within that realm will be\n  able to access files after authenticating.\n  \n  To selectively disable authentication within a protected uri hierarchy, set ``auth_digest`` \n  to “``off``” within a more-specific location block (see example).\n  \n  \nauth_digest_user_file\n~~~~~~~~~~~~~~~~~~~~~\n:Syntax: ``auth_digest_user_file`` */path/to/passwd/file*\n:Default: *unset*\n:Context: server, location\n:Description:\n  The password file should be of the form created by the apache ``htdigest`` command (or the \n  included `htdigest.py`_ script). Each line of the file is a colon-separated list composed \n  of a username, realm, and md5 hash combining name, realm, and password. For example:\n  ``joi:enfield:ef25e85b34208c246cfd09ab76b01db7``\n  This file needs to be readable by your nginx user!\n  \nauth_digest_timeout\n~~~~~~~~~~~~~~~~~~~\n:Syntax: ``auth_digest_timeout`` *delay-time*\n:Default: ``60s``\n:Context: server, location\n:Description:\n  When a client first requests a protected page, the server returns a 401 status code along with\n  a challenge in the ``www-authenticate`` header.\n  \n  At this point most browsers will present a dialog box to the user prompting them to log in. This\n  directive defines how long challenges will remain valid. If the user waits longer than this time\n  before submitting their name and password, the challenge will be considered ‘stale’ and they will\n  be prompted to log in again.\n  \nauth_digest_expires\n~~~~~~~~~~~~~~~~~~~\n:Syntax: ``auth_digest_expires`` *lifetime-in-seconds*\n:Default: ``10s``\n:Context: server, location\n:Description:\n  Once a digest challenge has been successfully answered by the client, subsequent requests \n  will attempt to re-use the ‘nonce’ value from the original challenge. To complicate MitM_\n  attacks, it's best to limit the number of times a cached nonce will be accepted. This\n  directive sets the duration for this re-use period after the first successful authentication.\n\nauth_digest_replays\n~~~~~~~~~~~~~~~~~~~\n:Syntax: ``auth_digest_replays`` *number-of-uses*\n:Default: ``20``\n:Context: server, location\n:Description:\n  Nonce re-use should also be limited to a fixed number of requests. Note that increasing this\n  value will cause a proportional increase in memory usage and the shm_size may have to be\n  adjusted to keep up with heavy traffic within the digest-protected location blocks.\n\nauth_digest_evasion_time\n~~~~~~~~~~~~~~~~~~~~~~~~\n:Syntax: ``auth_digest_evasion_time`` *time-in-seconds*\n:Default: ``300s``\n:Context: server, location\n:Description:\n  The amount of time for which the server will ignore authentication requests from a client\n  address once the number of failed authentications from that client reaches ``auth_digest_maxtries``.\n\nauth_digest_maxtries\n~~~~~~~~~~~~~~~~~~~~\n:Syntax: ``auth_digest_maxtries`` *number-of-attempts*\n:Default: ``5``\n:Context: server, location\n:Description:\n  The number of failed authentication attempts from a client address before the module enters\n  evasive tactics. For evasion purposes, only network clients are tracked, and only by address\n  (not including port number).  A successful authentication clears the counters.\n\nauth_digest_shm_size\n~~~~~~~~~~~~~~~~~~~~\n:Syntax: ``auth_digest_shm_size`` *size-in-bytes*\n:Default: ``4096k``\n:Context: server\n:Description:\n  The module maintains a fixed-size cache of active digest sessions to save state between \n  authenticated requests. Once this cache is full, no further authentication will be possible\n  until active sessions expire. \n  \n  As a result, choosing the proper size is a little tricky since it depends upon the values set in\n  the expiration-related directives. Each stored challenge takes up ``48 + ceil(replays/8)`` bytes\n  and will live for up to ``auth_digest_timeout + auth_digest_expires`` seconds. When using the\n  default module settings this translates into allowing around 82k non-replay requests every 70\n  seconds.\n\n.. _nginx: http://nginx.net\n.. _module: http://wiki.nginx.org/HttpAuthBasicModule\n.. _htdigest.py: https://github.com/samizdatco/nginx-http-auth-digest/blob/master/htdigest.py\n.. _RFC: http://www.ietf.org/rfc/rfc2617.txt\n.. _Digest Authentication: http://en.wikipedia.org/wiki/Digest_access_authentication\n.. _Issue Tracker: https://github.com/samizdatco/nginx-http-auth-digest/issues\n.. _MitM: http://en.wikipedia.org/wiki/Man-in-the-middle_attack\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fatomx%2Fnginx-http-auth-digest","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fatomx%2Fnginx-http-auth-digest","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fatomx%2Fnginx-http-auth-digest/lists"}