Feature Request: Improve Pode Authentication to Ensure RFC Compliance and Enhance Security

[mdaneri]

Description
Pode’s authentication mechanisms need improvements to ensure compliance with various RFCs, fix WWW-Authenticate headers on authentication failures, and enhance request handling. This request proposes updates to Digest Authentication, Basic Authentication, Bearer Authentication, Client Certificate Authentication, and Form Authentication to align with industry standards.

Proposed Enhancements

1. Digest Authentication Updates (RFC 7616 Compliance)

• Support for multiple algorithms: Add support for MD5, SHA-1, SHA-256, SHA-384, SHA-512, and SHA-512/256.
• Enhanced Quality of Protection (qop): Implement auth-int for message integrity verification.
• Algorithm negotiation: Allow clients to select the strongest supported algorithm.
• Fix WWW-Authenticate header: Ensure correct formatting and presence of WWW-Authenticate on authentication failures.

2. WWW-Authenticate Header Fixes for All Authentication Methods

Ensure WWW-Authenticate is properly returned when authentication fails, per RFC standards:

• Basic Authentication (RFC 7617): Returns WWW-Authenticate: Basic realm="ExampleRealm".
• Bearer Authentication (RFC 6750): Returns WWW-Authenticate: Bearer error="invalid_token".
• Client Certificate Authentication (RFC 5246): Ensures correct handling of TLS mutual authentication failures.
• Form Authentication: Consistently includes WWW-Authenticate on failed login attempts.
• Digest Authentication (RFC 7616): Properly formats and includes WWW-Authenticate, even on failure.

Why This is Needed

• Ensures Pode authentication mechanisms align with industry standards.
• Fixes compliance issues related to WWW-Authenticate headers.
• Strengthens security by supporting stronger hashing algorithms and message integrity verification.
• Improves authentication handling for various authentication schemes.

References

• [RFC 7616: Digest Authentication](https://datatracker.ietf.org/doc/html/rfc7616)
• [RFC 7617: Basic Authentication](https://datatracker.ietf.org/doc/html/rfc7617)
• [RFC 6750: Bearer Authentication](https://datatracker.ietf.org/doc/html/rfc6750)
• [RFC 5246: TLS Client Certificate Authentication](https://datatracker.ietf.org/doc/html/rfc5246)
• [Pode Documentation](https://github.com/Badgerati/Pode)