Today, we are deprecating support for Digest access authentication, or “Digest auth” on Bitbucket. Digest auth support is currently slated to be turned off on May 1st, 2015.
What is Digest authentication?
Digest auth (RFC-2617) is one of the older standardized methods of authenticating HTTP requests that was used to avoid sending a password in clear text, and to prevent replay attacks. Over unsecured channels it was (in the late 90s and early 00s) a much better approach than traditional Basic Auth. We have always offered Digest auth — currently under SSL only — as an alternative to Basic auth, but today very few users use it.
Why are we deprecating it?
Over the past couple of years, as SSL-only sites became the norm, having this end-to-end encryption has effectively made Digest auth obsolete. Today, Digest auth under SSL offers nothing over Basic Auth except added complexity and, in most cases, an additional round trip to request the necessary auth challenge.
Bitbucket has been SSL-only for years and we have been planning to deprecate Digest auth. In recent years, Bitbucket’s Digest auth support has been limited to select endpoints, and aimed at providing backwards compatibility with older clients only.
Next steps
As of May 1st, clients that exclusively support Digest auth will cease to work. This might affect some older curl-based scripts that use the `–digest` parameter. Simply removing that parameter will make curl use Basic auth (over SSL, of course) instead. For all users, we recommend using one of the more modern auth methods available.
