A PSR-7 and PSR-15 compliant HTTP Basic Authentication middleware for PHP frameworks.
tuupola/slim-basic-auth is a PHP middleware that implements HTTP Basic Authentication for web applications and APIs. It provides a standardized way to secure routes by requiring username and password credentials, solving the need for a simple, framework-agnostic authentication layer. The middleware is designed to work with any PSR-7 or PSR-15 compatible framework.
PHP developers building web applications or APIs with frameworks like Slim or Zend Expressive who need to quickly add HTTP Basic Authentication to protect specific routes or endpoints.
Developers choose this middleware for its strict adherence to PSR standards, ensuring compatibility across modern PHP frameworks, and its robust security features like HTTPS enforcement. Its flexibility in configuration and extensibility through custom authenticators sets it apart from simpler solutions.
PSR-7 and PSR-15 HTTP Basic Authentication Middleware
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Adheres to PSR-7 and PSR-15, ensuring seamless integration with frameworks like Slim and Zend Expressive, as highlighted in the README's compatibility examples.
Supports path-based protection, ignore rules, and custom authenticators, allowing granular control over which routes are secured without modifying core application logic.
Enforces HTTPS by default with configurable relaxed rules for development or proxy scenarios, promoting secure usage out of the box, as documented in the security section.
Provides before and after callbacks to modify requests and responses upon authentication, enabling customization like adding user attributes or headers without breaking middleware flow.
Allows credentials from hardcoded arrays, environment variables, PDO databases, or custom callables, offering versatility for different deployment and user management strategies.
Relies on HTTP Basic Authentication, which transmits credentials in plain text unless HTTPS is enforced, making it less secure for public-facing applications without proper encryption setup.
Version 3.x is not backwards compatible with 2.x, requiring careful upgrading and potential code adjustments, as noted in the README's heads-up and UPGRADING guide.
Only implements basic auth, lacking support for more advanced methods like session management or OAuth, which might necessitate additional middleware for complex applications.