The Dead Drop · Digest Auth

Real HTTP Digest Auth from a live backend — most driver credential helpers only speak Basic, so this needs a hand-computed MD5 response.

Same door as the vault, a harder lock. Your driver's one-liner doesn't open this one.

Digest Auth is a hard Network & Auth challenge on Fun UI Playground. Real HTTP Digest Auth from a live backend — most driver credential helpers only speak Basic, so this needs a hand-computed MD5 response. It needs the site’s live backend for real HTTP behavior. Every interactive element carries a stable id and data-testid prefixed with “digest-auth-”, and the techniques it exercises are HTTP Digest Auth, challenge-response auth, compute MD5 response, nonce handling.

At a glance

Category
Network & Auth
Difficulty
hard
Teaches
HTTP Digest Auth · challenge-response auth · compute MD5 response · nonce handling
Backend
Needs the live /api backend
Locators
Stable id and data-testid, prefixed digest-auth-

Selectors on this page

LocatorWhat it is
h1#dead-drop-openAuthenticated → 200 with a themed success page (h1#dead-drop-open)

Frequently asked questions

Why doesn't my driver's credential helper work with Digest Auth?

Because Playwright's httpCredentials and Selenium's credentials-in-URL only speak Basic. Digest is challenge-response: read the 401's WWW-Authenticate: Digest header and compute MD5(MD5(user:realm:pass) : nonce : nc : cnonce : qop : MD5(method:uri)). Python's requests ships HTTPDigestAuth for exactly this.

What should a client do when a Digest nonce goes stale?

Retry silently with a fresh nonce. GET /api/digest-auth rejects a nonce older than five minutes with stale=true, and the correct behavior is one more request rather than re-prompting. A success answers 200 with h1#dead-drop-open.

More Network & Auth

Updated

Fun UI Playground — all challenges, bug hunts, getting started, glossary, about.