[2.4.x] further mod_auth_digest improvements

.gitleaks.toml

@@ -0,0 +1,11 @@
+# Gitleaks scanner config to prevent false positives
+# see https://github.com/gitleaks/gitleaks
+[allowlist]
+description = "Global Allowlist"
+
+# Ignore based on any subset of the file path
+paths = [
+# Ignore all authentication tests which do contain
+# embedded test passwords.
+'''test\/modules\/aaa\/*\.py''',
+]

changes-entries/digest-authinfo-errors.txt

@@ -0,0 +1,3 @@
+  *) mod_auth_digest: With one-time nonces (AuthDigestNonceLifetime 0),
+     stop needlessly re-challenging a client after an error response.
+     [Joe Orton]

changes-entries/digest-shmem-size.txt

@@ -0,0 +1,3 @@
+  *) mod_auth_digest: Increase the default AuthDigestShmemSize to 8192
+     bytes, tracking around 140 clients rather than around 12.
+     [Joe Orton]

docs/manual/mod/mod_auth_digest.xml

@@ -240,7 +240,7 @@ authentication</description>
 <description>The amount of shared memory to allocate for keeping track
 of clients</description>
 <syntax>AuthDigestShmemSize <var>size</var></syntax>
-<default>AuthDigestShmemSize 1000</default>
+<default>AuthDigestShmemSize 8192</default>
 <contextlist><context>server config</context></contextlist>
 
 <usage>
@@ -254,6 +254,13 @@ of clients</description>
     <code>0</code> and read the error message after trying to start the
     server.</p>
 
+    <p>The default holds roughly 140 clients. A client which is discarded
+    to make room for another is not denied access: it is issued a new
+    nonce with <code>stale=true</code>, which costs it one extra request.
+    Note that a request which does not authenticate also takes an entry,
+    since the challenge sent back to it carries the identifier the client
+    is tracked by.</p>
+
     <p>The <var>size</var> is normally expressed in Bytes, but you
     may follow the number with a <code>K</code> or an <code>M</code> to
     express your value as KBytes or MBytes. For example, the following