Re: [security-dev] Undertow IDM

One point - within Undertow access to the IDM should not necessarily be considered an authentication attempt, i.e. in Digest the IDM may be accessed even if the nonce is known to be out of date. However we do have a notification framework within Undertow for successful and failed authentication attempts - that would be a better point to handle any locking. Although at the same point would need be very careful how this is handled before it becomes an easy denial of service route. On 24/04/13 20:38, Pedro Igor Silva wrote: That is going to be a bigger discussion but not one for this thread, in Undertow we need support for stronger hashes in addition to MD5 and also need access to the pre-hashed value at the very least to complete the Digest implementation.