Authentication-Info

After a server accepts client credentials, additional authentication data flows back through the Authentication-Info response header. This header returns Authentication parameters following a successful Authorization exchange.

Table of Contents

Usage
Directives
Example
Mutual authentication nobody completes
See also

Usage

The Authentication-Info header appears in responses where the server has successfully authenticated the client. The header provides the server with a way to send additional authentication data back to the client, including updated nonces for subsequent requests and response digests for mutual authentication.

Digest authentication schemes use this header to implement features like nonce rotation and mutual authentication. When the server sends a nextnonce parameter, the client uses the new nonce for the next request instead of the original nonce. The rspauth parameter allows the client to verify the server knows the shared secret, providing protection against server impersonation attacks.

The header parameters follow the same authentication scheme indicated by the WWW-Authenticate header in the original challenge. Different authentication schemes define different parameters for this header.

Directives

nextnonce

The nextnonce parameter provides a new nonce value for the client to use on the next request. Servers send this to implement one-time nonces or rotating nonces. The client replaces the original nonce with this value when constructing the next Authorization header.

rspauth

The rspauth (response authentication) parameter contains a digest computed by the server to prove the server knows the client's credentials. The client verifies this digest to confirm the server's identity, providing mutual authentication. This parameter appears when the quality of protection includes authentication (qop=auth or qop=auth-int).

qop

The qop (quality of protection) parameter indicates which protection level applies to the response. The value auth means authentication only. The value auth-int means authentication with integrity protection of the response message body.

cnonce

The cnonce (client nonce) parameter echoes back the client nonce value sent in the Authorization header. The parameter serves as confirmation the server processed the client's nonce. Required when qop=auth or qop=auth-int is specified.

nc

The nc (nonce count) parameter echoes back the hexadecimal count of requests the client has sent with the current nonce value. Required when qop=auth or qop=auth-int is specified.

Example

A server returns authentication parameters after accepting the client's Digest authentication credentials. The nextnonce parameter rotates the nonce for the next request, and rspauth provides a digest the client verifies to authenticate the server.

Authentication-Info: nextnonce="4ee60b", rspauth="3e8f9d1c2a5b4d7e", qop=auth, cnonce="0a4f113b", nc=00000001

Mutual authentication nobody completes

The Digest parameters inside Authentication-Info promise something Authorization alone never delivers: rspauth is the server proving knowledge of the password back to the client, computed over the request URI without the method, so the value is a distinct proof rather than an echo of the client's digest.

The promise dies on the client side. Apache's Digest module dutifully emits the field, and the dominant HTTP clients never check the answer: neither Firefox nor curl contains any code verifying rspauth, with Firefox generating the client nonce enabling the proof and then discarding the server's response to the offer. Mutual authentication exists on the wire and stops there.

nextnonce carries a real cost alongside the security. A server rotating nonces every response forces the client to wait for each answer before building the next request, which serializes pipelined connections, and the specification itself advises weighing the tradeoff. Apache narrows the issue by sending nextnonce only inside the final 30 seconds of a nonce's life.

The field also carries interop quirks worth knowing cold: nextnonce, rspauth, and cnonce require quoted strings, qop and nc forbid them, and nc is exactly eight hexadecimal digits.