Opaque field ignored

[samizdatco]

the opaque field is not used when generating challenges, nor is it validated when included in an authentication request. is this a significant omission? the spec makes it seem as though it only exists as a convenience to stash state in, but i could believe some software out there depends upon it...

[erikdubbelboer]

See

nginx-http-auth-digest/bugs.txt

Lines 22 to 25 in bd1c86a

	- the opaque field is not used when generating challenges, nor is it validated when included
	in an authentication request. is this a significant omission? the spec makes it seem as
	though it only exists as a convenience to stash state in, but i could believe some software
	out there depends upon it...