auth_digest_expires
Sets the duration after which digest authentication credentials will expire.
Description
The auth_digest_expires directive specifies the time period after which authentication credentials issued during a digest authentication session will expire. This is crucial for maintaining security by ensuring that credentials do not remain valid indefinitely. The specified duration is measured in seconds, and it affects how long clients can reuse their credentials before they must re-authenticate. When the specified expiration time passes, the server will no longer accept the previously issued credentials from the client, which forces them to provide their credentials again.
The directive can be applied in various contexts, including http, server, and location, allowing for flexible configuration depending on the scope needed. It takes a single numeric argument that indicates the duration in seconds. If not explicitly set, the default behavior will rely on internal defaults, potentially leading to less secure outcomes if credentials are left valid too long.
For effective usage, it is essential to consider the trade-off between user convenience and security; setting a shorter expiration time may enhance security but could negatively impact the user experience as repeated authentication will be required. Overall, auth_digest_expires plays a key role in striking that balance by ensuring that clients are required to re-authenticate at defined intervals, thereby reducing the risk of unauthorized access due to stolen or intercepted credentials.
Config Example
location /protected {
auth_digest "Protected Area";
auth_digest_user_file /etc/nginx/.htdigest;
auth_digest_expires 300;
}If this directive is set too high, it may lead to security vulnerabilities by allowing long-lived credentials.
Not setting the directive explicitly means that the default value of 10 seconds is used, which may be insufficient for certain use cases.
Ensure that proper testing is conducted when adjusting expiration values as it could impact user experience negatively.