1         public static bool IsValid(string nonce, string nonceCount)
 2         {
 3             Tuple<int, DateTime> cachedNonce = null;
 4             nonces.TryGetValue(nonce, out cachedNonce);
 5 
 6             if (cachedNonce != null) // nonce is found
 7             {
 8                 // nonce count is greater than the one in record
 9                 if (Int32.Parse(nonceCount) > cachedNonce.Item1)
10                 {
11                     // nonce has not expired yet
12                     if (cachedNonce.Item2 > DateTime.Now)
13                     {
14                         // update the dictionary to reflect the nonce count just received in this request
15                         nonces[nonce] = new Tuple<int, DateTime>(Int32.Parse(nonceCount),
16                                                                                                             cachedNonce.Item2);
17 
18                         // Every thing looks ok - server nonce is fresh and nonce count seems to be 
19                         // incremented. Does not look like replay.
20                         return true;
21                     }
22                 }
23             }
24 
25             return false;
26         }

 1 namespace DigestAuthentication
 2 {
 3     public class AuthenticationHandler : DelegatingHandler
 4     {
 5         protected async override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
 6         {
 7             try
 8             {
 9                 var headers = request.Headers;
10                 if (headers.Authorization != null)
11                 {
12                     Header header = new Header(request.Headers.Authorization.Parameter,
13                                                                                                                       request.Method.Method);
14 
15                     if (Nonce.IsValid(header.Nonce, header.NounceCounter))
16                     {
17                         // Just assuming password is same as username for the purpose of illustration
18                         string password = header.UserName;
19 
20                         string ha1 = String.Format("{0}:{1}:{2}", header.UserName, header.Realm,
21                                                                                                                              password).ToMD5Hash();
22 
23                         string ha2 = String.Format("{0}:{1}", header.Method, header.Uri).ToMD5Hash();
24 
25                         string computedResponse = String
26                                       .Format("{0}:{1}:{2}:{3}:{4}:{5}",
27                                             ha1, header.Nonce, header.NounceCounter,
28                                                                                          header.Cnonce, "auth", ha2).ToMD5Hash();
29 
30                         if (String.CompareOrdinal(header.Response, computedResponse) == 0)
31                         {
32                             // digest computed matches the value sent by client in the response field.
33                             // Looks like an authentic client! Create a principal.
34                             var claims = new List<Claim>
35                             {
36                                             new Claim(ClaimTypes.Name, header.UserName),
37                                             new Claim(ClaimTypes.AuthenticationMethod, AuthenticationMethods.Password)
38                             };
39 
40                             var principal = new ClaimsPrincipal(new[] { new ClaimsIdentity(claims, "Digest") });
41 
42                             Thread.CurrentPrincipal = principal;
43 
44                             if (HttpContext.Current != null)
45                                 HttpContext.Current.User = principal;
46                         }
47                     }
48                 }
49 
50                 var response = await base.SendAsync(request, cancellationToken);
51 
52                 if (response.StatusCode == HttpStatusCode.Unauthorized)
53                 {
54                     response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Digest",
55                                                                                      Header.UnauthorizedResponseHeader.ToString()));
56                 }
57 
58                 return response;
59             }
60             catch (Exception)
61             {
62                 var response = request.CreateResponse(HttpStatusCode.Unauthorized);
63                 response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Digest",
64                                                                                        Header.UnauthorizedResponseHeader.ToString()));
65 
66                 return response;
67             }
68         }
69     }
70 
71 }