Digest authentication is an HTTP authentication scheme that proves a user's identity without ever transmitting the actual password, instead sending a cryptographic hash derived from the password combined with server-supplied and request-specific data.
Key Points: • The server sends a unique "nonce" value that the client must include when hashing the password. • The client computes a digest (typically MD5-based) from the username, password, nonce, and request details. • The server independently computes the same digest and compares it to what the client sent. • Because the raw password is never transmitted, digest auth is safer than Basic authentication over plain HTTP. • It's largely superseded today by token-based schemes like OAuth2/JWT over HTTPS, which are simpler to implement and more widely supported.
Example: A legacy internal tool still uses digest authentication so that even if traffic were intercepted, the attacker would only see a hashed, nonce-bound value rather than the actual password.
Interview Tip: A concise interview answer is:
"Digest authentication proves identity by hashing the password together with a server-issued nonce instead of sending the password itself, so it's safer than Basic auth over unencrypted connections. It's largely legacy now—most modern applications use HTTPS with OAuth2 or JWT-based token authentication instead."