Modified ESP8266WebServer to allow for authentication with H(A1).

[overtone1000]

RFC 2617 4.13 discusses storing credentials as the username and H(A1) rather than the username and password, but this isn't possible with the current implementation of Digest authentication in the ESP8266WebServer class because the authenticate function takes username and password as arguments. This limitation is addressed in this branch, which contains four modifications:

1. Exposes a function in ESP8266WebServer that performs HTTP Digest authentication with username and H(A1) as the arguments.
2. Preserves the HTTP authentication function in ESP8266WebServer with username and password as arguments but modifies it to call the new function where appropriate.
3. Adds a public static function to ESP8266WebServer for generating H(A1) from the username, realm, and password.
4. Adds an example of how to use this new feature, which is called HttpHashCredAuth.ino and is in the appropriate folder. This example uses the ESP8266WebServerSecure class to present a web interface where the user can change the HTTP credentials. These are saved in SPIFFS as the username and H(A1). The plain text password is never stored in the program or the file system.

[overtone1000]

This branch was tested with the new example as well as with the HttpAdvancedAuth.ino and HttpBasicAuth.ino examples to make sure no existing functionality was disrupted. All three examples compiled and functioned as expected.

[overtone1000]

I have only found one issue (#4392) that asked a related question about digest authentication, but this was closed as the question was about the security of the transmission, not about its storage. This issue was quickly closed.

I have found two pull requests (#3328 and #4404) that address a similar issue with basic authentication.

[earlephilhower]

Seems fine to me, with the prior comments. Not sure if it's going to give much more security (especially since raw user/real/passwords are still stored in 8266 flash...ugh), but I don't think it affects anything negatively.

[overtone1000]

especially since raw user/real/passwords are still stored in 8266 flash...ugh

My goal for the example (HttpHashCredAuth.ino) was to show how to avoid this. The credentials are initialized to something generic, but once they are changed through the web interface, only the user name and hash of user/real/password should be in flash. What did I miss?

[earlephilhower]

Ah, did not catch you were only writing the hash in SPIFFS. Looks good to me, we'll see what CI thinks of it. Thanks!
-EFP3

[earlephilhower]

LGTM now!

[earlephilhower]

Thanks for the contribution, @overtone1000! 2.5.2 just came out so we can start adding feature updates like this.

[overtone1000]

I'm very appreciative of the work you all do on this project. This is my first ever PR, so thank you for helping me!

[twinclouds]

Got the following error:
'class BearSSL::ESP8266WebServerSecure' has no member named 'authenticateDigest'.
How to fix?

[overtone1000]

@twinclouds, which version of the core are you using? This has been merged into the master branch but isn't yet part of the current release (2.5.2). If you need this feature now you'll need to use the current git version as described in the readme file in the root of this repositoty.