module ActionController::HttpAuthentication::Digest

the time cannot be modified by client.
key from the \Rails session secret generated upon creation of project. Ensures
The nonce is opaque to the client. Composed of Time, and hash of Time with secret

of this document.
POST, PUT, or PATCH requests, and a time-stamp for GET requests. For more details on the issues involved see Section 4
protect against a replay attack. Or, an implementation might choose to use one-time nonces or digests for
An implementation might choose not to accept a previously used nonce or a previously used digest, in order to

Also, IP address spoofing is not that hard.)
However, that would break proxy farms, where requests from a single user often go through different proxies in the farm.
to limit the reuse of the nonce to the same client that originally got it.
(Note: including the IP address of the client in the nonce would appear to offer the server the ability
The inclusion of the ETag prevents a replay request for an updated version of the resource.
if the time-stamp value is not recent enough. In this way the server can limit the time of the nonce's validity.
reject the request if it did not match the nonce from that header or
With a nonce of this form a server would recalculate the hash portion after receiving the client authentication header and
and private-key is data known only to the server.
ETag is the value of the HTTP ETag header associated with the requested entity,
where time-stamp is a server-generated time or other non-repeating value,

time-stamp H(time-stamp ":" ETag ":" private-key)

A nonce might, for example, be constructed as the base 64 encoding of
The quality of the implementation depends on a good choice.
The contents of the nonce are implementation dependent.

Specifically, since the string is passed in the header lines as a quoted string, the double-quote character is not allowed.
It is recommended that this string be base64 or hexadecimal data.
A server-specified data string which should be uniquely generated each time a 401 response is made.

Uses an MD5 digest based on time to generate a value to be used only once.

def nonce(secret_key, time = Time.now)
  t = time.to_i
  hashed = [t, secret_key]
  digest = OpenSSL::Digest::MD5.hexdigest(hashed.join(":"))
  ::Base64.strict_encode64("#{t}:#{digest}")
end