如何使用Aleph库实现摘要认证（Digest Authentication）？

Aleph本身没有内置的摘要认证（Digest Authentication）支持，但可以通过手动处理认证流程或者复用已有工具逻辑来实现，以下是两种可行方案：

方案一：手动构建摘要认证头 #

手动实现需要遵循摘要认证的RFC规范，步骤如下：

• 发送不带认证的请求，获取服务器返回的WWW-Authenticate头信息
• 解析该头中的realm、nonce等关键参数
• 按照MD5（常用算法）计算response值
• 构造Authorization请求头并重新发送请求

示例代码（需引入clj-digest库处理MD5计算）：

(require '[aleph.http :as http]
         '[clojure.string :as str]
         '[digest :refer [md5]])

(defn calculate-digest-response [username password realm nonce uri method]
  (let [ha1 (md5 (str username ":" realm ":" password))
        ha2 (md5 (str method ":" uri))]
    (md5 (str ha1 ":" nonce ":" ha2))))

(defn digest-auth-request [method url username password]
  (let [first-response @(http/request {:method method :url url})
        auth-header (get-in first-response [:headers "www-authenticate"])
        realm (second (re-find #"realm=\"([^\"]+)\"" auth-header))
        nonce (second (re-find #"nonce=\"([^\"]+)\"" auth-header))
        response (calculate-digest-response username password realm nonce (str/lower-case (name method)) url)
        auth-value (str "Digest username=\"" username "\", realm=\"" realm "\", nonce=\"" nonce "\", uri=\"" url "\", response=\"" response "\"")]
    @(http/request {:method method
                    :url url
                    :headers {"Authorization" auth-value}
                    :as :stream})))

; 调用示例
(digest-auth-request :post "你的目标URL" "用户名" "密码")

方案二：复用clj-http的认证逻辑 #

既然你已经熟悉clj-http的digest-auth实现，可以直接借助它的认证函数生成正确的请求头，再传递给Aleph：

(require '[aleph.http :as http]
         '[clj-http.client :as client]
         '[clj-http.auth :as auth])

(defn aleph-digest-post [url username password]
  ; 先发送无认证请求获取服务器的认证要求
  (let [initial-response @(http/request {:method :post :url url})
        auth-challenge (get-in initial-response [:headers "www-authenticate"])
        ; 利用clj-http的digest-auth-fn计算认证头
        auth-fn (auth/digest-auth-fn username password)
        authenticated-request (auth-fn {:url url :method :post} {:status 401 :headers {"www-authenticate" auth-challenge}})
        auth-header (get-in authenticated-request [:headers "Authorization"])]
    @(http/post url {:headers {"Authorization" auth-header}
                     :as :stream})))

这个方案更简洁，直接复用了clj-http经过验证的认证逻辑，不需要自己处理摘要算法的细节。

内容的提问来源于stack exchange，提问作者Felipe Gerard