Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is the opaque field really used for anything? It is specified in the RFC, but is not implemented in Apache. Also, the RFC does not state a reason for having opaque, it is only mentioned as a value that should be returned to the sender.
I'm thinking that it may be used to prove that the response-opaque came from a request that was made earlier in time.
If you drill into the An Extension to HTTP : Digest Access Authentication RFC, they define opaque as follows:
opaque: A string of data, specified by the server, which should be returned by the client unchanged. It is recommended that this string be base64 or hexadecimal data. This field is a "quoted-string" as specified in section 2.2 of the HTTP/1.1 specification.
which is pretty close to what you saw in the RFC you mentioned, further in the get into details a little more
The opaque data is useful for transporting state information around.
For example, a server could be responsible for authenticating content which actually sits on another server. The first 401 response would
include a domain field which includes the URI on the second server,
and the opaque field for specifying state information. The client
will retry the request, at which time the server may respond with a
301/302 redirection, pointing to the URI on the second server. The
client will follow the redirection, and pass the same Authorization
header, including the data which the second server may
require.
