RFC-7616 HTTP Digest Access Authentication

SonicOS API supports the RFC-7616 HTTP Digest Access Authentication scheme as its most secure. It includes:

• Secure authentication using SHA-256, extensible for other algorithms in the future.
• Replay prevention utilizing a counter that is incremented in each request and can be reset to any value at any time in replies from the firewall.
• An option for a “rolling nonce,” where an HTTP reply can optionally pass back a new nonce (random number) to be used for the next request.
• Optional “integrity protection” where requests with entity body content can include that in the digest calculation.
• An optional “session” variant that uses a SHA hash of the password instead of the password itself so that the SonicWall/client do not need to store the actual password.

For SonicOS API HTTP Digest Access Authentication, use the Linux command-line curl command with the -u option:

• Login:

  curl -k -i -u admin:password -digest -X HEAD https://a.b.c.d/api/sonicos/auth