Is the opaque field really used for anything? It is specified in the RFC, but is not implemented in Apache. Also, the RFC does not state a reason for having opaque, it is only mentioned as a value that should be returned to the sender.

I'm thinking that it may be used to prove that the response-opaque came from a request that was made earlier in time.

  • 1
    "The opaque data is useful for transporting state information around" what do you mean by "state information"? can you please clarify. Thanks
    – JamJam
    Feb 26, 2016 at 1:03

1 Answer 1


If you drill into the An Extension to HTTP : Digest Access Authentication RFC, they define opaque as follows:

opaque: A string of data, specified by the server, which should be returned by the client unchanged. It is recommended that this string be base64 or hexadecimal data. This field is a "quoted-string" as specified in section 2.2 of the HTTP/1.1 specification.

which is pretty close to what you saw in the RFC you mentioned, further in the get into details a little more

The opaque data is useful for transporting state information around.
For example, a server could be responsible for authenticating content which actually sits on another server. The first 401 response would
include a domain field which includes the URI on the second server,
and the opaque field for specifying state information. The client
will retry the request, at which time the server may respond with a
301/302 redirection, pointing to the URI on the second server. The
client will follow the redirection, and pass the same Authorization
header, including the data which the second server may

  • 1
    Good eye! Surprising that the old RFC is more detailed.. Nov 23, 2012 at 19:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .