auth

README

auth

Macaron middleware/handler for http basic authentication. Modified from https://github.com/martini-contrib/auth

API Reference

Simple Usage

Use auth.Basic to authenticate against a pre-defined username and password:

import (
  "gopkg.in/macaron.v1"
  "github.com/go-macaron/auth"
)

func main() {
  m := macaron.Classic()
  // authenticate every request
  m.Use(auth.Basic("username", "secretpassword"))
  m.Run()
}

Advanced Usage

Using auth.BasicFunc lets you authenticate on a per-user level, by checking the username and password in the callback function:

import (
  "gopkg.in/macaron.v1"
  "github.com/go-macaron/auth"
)

func main() {
  m := macaron.Classic()
  // authenticate every request
  m.Use(auth.BasicFunc(func(username, password string) bool {
    return username == "admin" && password == "guessme"
  }))
  m.Run()
}

Note that checking usernames and passwords with string comparison might be susceptible to timing attacks. To avoid that, use auth.SecureCompare instead:

  m.Use(auth.BasicFunc(func(username, password string) bool {
    return auth.SecureCompare(username, "admin") && auth.SecureCompare(password, "guessme")
  }))
}

Upon successful authentication, the username is available to all subsequent handlers via the auth.User type:

  m.Get("/", func(user auth.User) string {
    return "Welcome, " + string(user)
  })
}

Authors

• Jeremy Saenz
• Brendon Murphy
• codeskyblue

Documentation

Index

• Variables
• func Basic(username string, password string) macaron.Handler
• func BasicFunc(authfn func(string, string) bool) macaron.Handler
• func SecureCompare(given string, actual string) bool
• type User

Variables

var BasicRealm = "Authorization Required"

BasicRealm is used when setting the WWW-Authenticate response header.

Functions

func Basic

func Basic(username string, password string) macaron.Handler

Basic returns a Handler that authenticates via Basic Auth. Writes a http.StatusUnauthorized if authentication fails.

func BasicFunc

func BasicFunc(authfn func(string, string) bool) macaron.Handler

BasicFunc returns a Handler that authenticates via Basic Auth using the provided function. The function should return true for a valid username/password combination.

func SecureCompare

func SecureCompare(given string, actual string) bool

SecureCompare performs a constant time compare of two strings to limit timing attacks.

Types

type User

type User string

User is the authenticated username that was extracted from the request.