php|architect's Guide to Web Scraping with PHP - Wind Business ...

HTTP ” 21
Digest HTTP Authentication
Digest authentication is a bit more involved. The WWW-Authenticate header returned
by the server will contain the word “Digest” follo wed by a single space and then by a
number of key -value pairs in the format key=“value” separated by commas. Belo w is
an example of this header.
WWW-Authenticate: Digest realm="testrealm@host.com",
qop="auth,auth-int",
nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
opaque="5ccc069c403ebaf9f0171e9517f40e41"
The client must respond with a specific response value that the server will verify before
it allo ws the client to proceed. To derive that value requires use of the MD5 hash
algorithm, which in PHP can be accessed using the md5 or hash functions. H ere is the
process.
• Concatenate the appropriate username, the value of the realm key pro vided
by the server, and the appropriate password together separated by colons and
take the MD5 hash of that string. W e’ll call this HA1. It shouldn’t change for
the rest of the session.
• Concatenate the method and URI of the original request separated by a colon
and take the MD5 hash of that string. W e’ll call this HA2. This will ob viously
vary with your method or URI.