Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is the opaque field really used for anything? It is specified in the RFC, but is not implemented in Apache. Also, the RFC does not state a reason for having opaque, it is only mentioned as a value that should be returned to the sender.

I'm thinking that it may be used to prove that the response-opaque came from a request that was made earlier in time.

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

If you drill into the An Extension to HTTP : Digest Access Authentication RFC, they define opaque as follows:

opaque: A string of data, specified by the server, which should be returned by the client unchanged. It is recommended that this string be base64 or hexadecimal data. This field is a "quoted-string" as specified in section 2.2 of the HTTP/1.1 specification.

which is pretty close to what you saw in the RFC you mentioned, further in the get into details a little more

The opaque data is useful for transporting state information around.
For example, a server could be responsible for authenticating content which actually sits on another server. The first 401 response would
include a domain field which includes the URI on the second server,
and the opaque field for specifying state information. The client
will retry the request, at which time the server may respond with a
301/302 redirection, pointing to the URI on the second server. The
client will follow the redirection, and pass the same Authorization
header, including the data which the second server may
require.

share|improve this answer
    
Good eye! Surprising that the old RFC is more detailed.. –  Henning Klevjer Nov 23 '12 at 19:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.