From: <glassfish_at_javadesktop.org>
Date: Sat, 28 Feb 2009 17:38:48 PST

Answering my own question:

http://en.wikipedia.org/wiki/Digest_access_authentication#Impact_of_MD5_security_on_Digest_authentication

It seems that:

1) The hash algorithm must be MD5
2) The server must store the plain-text password or MD5(username:realm:password)

Storing plain-text passwords is problematic because if your database is ever compromised all account passwords are exposed. Storing MD5 hash is also problematic because you cannot rename the Realm in the future and you cannot use a different salt per account.

I'm going to look into using HTTP-Basic over SSL instead.
[Message sent by forum member 'cowwoc' (cowwoc)]

http://forums.java.net/jive/thread.jspa?messageID=334435