users@jersey.java.net

Secure digest authentication with jersey client + jersey on HttpServer ?

From: Morten <mortench2004_at_yahoo.dk>
Date: Mon, 20 Jul 2009 11:02:24 +0000 (GMT)

Apparently Jersey client and Jersey running on Java6's com.sun.net.httpserver.HttpServer only provides out of the box support for basic authentication. Unfortunately,  basic authentication is outdated and INSECURE as passwords are send in the clear over the wire!

Instead I would like to use to much more secure HTTP Digest access authentication which is based on nonces instead of passwords and work with plain sockets (SSL not necessary). This digest scheme is generally recommended to use instead of basic authentication (SSL is not an option for me as I am developing an internal application intranet where signed SSL certificates are not applicable).

Anyone out there with a solution for digest authentication which works with Jersey running on Java6's HttpServer and also working with Jersey client (on top of Apache HttpClient) ?

Cheers,
Morten