Simply put, the digest authentication goes as follows:
- The user tries to access some resource that requires authentication.
- The server responds with 401 and the www-authenticate header.
- The client responds with a request that includes the authentication header and the required fields.
- The server allows the user access to the resource.
My question is, how does the user authenticate to any other resource? does the server set a cookie with the sessionID or something or the user has to send the authenticate header with every subsequent request?