[ https://issues.jboss.org/browse/ELY-154?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse commented on ELY-154: -------------------------------------- What this means is the password is never revealed in any re-usable form. Where we have username / realm / password hashes that hash can then be used both client side and server side for future messages. Session based Digest mean that the only hashes in the application server are never re-usable, if the heap of the application server was stolen and the hashes on the heap analysed they would not be useful. There does then need to be another server able to generate these session based hashes. -- This message was sent by Atlassian JIRA (v7.5.0#75005)