I don&#x27;t understand your point. Even if the client sends HASH(password), that effectively becomes the credential. That&#x27;s where HTTP Digest is less successful (as was pointed out by a sibling and I went D&#x27;oh for not remembering).<p>&gt; At a minimum you should be hashing whatever the client sends and storing that.<p>That&#x27;s a very narrow view of how to authenticate. SRP and client certs certainly don&#x27;t work that way.