Struct Authenticator 

pub struct Authenticator { /* private fields */ }

A server that issues digest challenges and checks the answers.

Nonces are self-describing: each carries its issue time and a MAC over it, so this can recognise its own nonce and read its expiry without a table of every nonce ever issued. The only table is the replay window, which is bounded and holds nothing that has not been used.

Implementations

impl Authenticator

pub fn new(realm: impl Into<String>, secret: [u8; 32]) -> Self

A server for a protection space.

secret keys the nonce MAC. It must be stable across restarts if in-flight nonces are to survive one, and not shared with another realm, or a nonce issued for one protection space is accepted in the other.

pub fn with_random_secret(realm: impl Into<String>) -> Self

A server with a freshly generated secret.

Convenient, and it means every restart invalidates every outstanding nonce — which clients recover from with stale=true, so it costs a round trip and not a login.

pub fn with_algorithm(self, algorithm: Algorithm) -> Self

Challenge with this algorithm.

SHA-256 by default rather than MD5. RFC 8760 §2 exists because MD5 should not be the only thing on offer, and a server choosing the default is the only place that choice can be made — a client can only answer what it is asked.

pub fn with_lifetime(self, lifetime: Duration) -> Self

How long an issued nonce stays valid.

pub fn realm(&self) -> &str

The protection space.

pub fn challenge_header(proxy: bool) -> HeaderName

The header a challenge goes in: WWW-Authenticate, or Proxy-Authenticate for a proxy.

pub fn challenge(&self, stale: bool) -> String

Mint a challenge value, as it goes in the header.

stale says the previous credentials were right and only the nonce was old.

pub fn challenge_at(&self, stale: bool, now: u64) -> String

Authenticator::challenge with the clock supplied, so a test can pin it.

pub fn verify( &mut self, presented: &Presented, method: &str, password: &str, ) -> Verdict

Check the credentials a request presented.

password is the one this server holds for presented.username; looking it up is the caller’s job, because a credential store is not this crate’s business. method is the request’s, since the digest covers it.

pub fn verify_at( &mut self, presented: &Presented, method: &str, password: &str, now: u64, ) -> Verdict

Authenticator::verify with the clock supplied.

Trait Implementations

impl Debug for Authenticator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.