An Elixir Plug for adding HTTP basic authentication to web applications with configurable credentials or custom authentication functions.
BasicAuth is an Elixir Plug that provides HTTP basic authentication for web applications. It allows developers to easily secure routes or controllers by requiring username and password credentials, either through static configuration or custom authentication logic. The project is now deprecated as its functionality has been merged into the main Plug library.
Elixir developers building web applications with Phoenix or other Plug-based frameworks who need to add HTTP basic authentication to secure specific routes, controllers, or actions.
Developers choose BasicAuth for its simplicity and seamless integration with Elixir's Plug architecture, offering both static credential configuration and custom authentication functions. It provides essential security features like timing attack protection and flexible deployment options without unnecessary complexity.
Elixir Plug to easily add HTTP basic authentication to an app
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Easily adds basic auth to controllers or router pipelines with minimal code, as shown in the usage examples for static configuration or custom callbacks.
Allows implementation of custom logic like database lookups via a three-arity callback function, providing flexibility beyond static credentials.
Includes secure comparison for static credentials to prevent timing attacks, emphasized in the README for versions 2.2.2 and above.
Supports runtime configuration with environment variables using {:system, "VAR_NAME"} syntax, ideal for deployments with tools like Distillery.
The project is no longer maintained independently and has been integrated into Plug, meaning users should migrate to avoid outdated code and lack of updates.
HTTP basic authentication is inherently less secure for modern apps, requiring HTTPS to protect credentials and lacking features like token refresh or scopes.
When using custom authentication, developers must implement their own timing-attack-safe comparisons, adding complexity and potential risks if mishandled.