cnonce

cnonce refers to a client nonce, a cryptographic term commonly used in HTTP authentication. A nonce, which is short for "number used once," is a random or pseudo-random number that is generated for a specific transaction. In the context of HTTP Digest authentication, the server provides a nonce to the client as part of the authentication challenge. The client then uses this nonce, along with its username, the requested URI, and its password (which is not transmitted directly), to compute a response digest. This response digest is sent back to the server, which can then verify the client's identity without the password ever traveling over the network. The nonce is crucial for security as it prevents replay attacks, where an attacker might intercept a valid authentication exchange and reuse it later to gain unauthorized access. Each authentication attempt typically requires a fresh nonce from the server to ensure that previously computed digests become invalid. This mechanism is part of the HTTP Digest Access Authentication scheme, designed as a more secure alternative to Basic Authentication.