Slim Basic Auth
A PSR-7 and PSR-15 compliant HTTP Basic Authentication middleware for PHP frameworks.
What is Slim Basic Auth?
tuupola/slim-basic-auth is a PHP middleware that implements HTTP Basic Authentication for web applications and APIs. It provides a standardized way to secure routes by requiring username and password credentials, solving the need for a simple, framework-agnostic authentication layer. The middleware is designed to work with any PSR-7 or PSR-15 compatible framework.
PHP developers building web applications or APIs with frameworks like Slim or Zend Expressive who need to quickly add HTTP Basic Authentication to protect specific routes or endpoints.
Developers choose this middleware for its strict adherence to PSR standards, ensuring compatibility across modern PHP frameworks, and its robust security features like HTTPS enforcement. Its flexibility in configuration and extensibility through custom authenticators sets it apart from simpler solutions.
Overview
PSR-7 and PSR-15 HTTP Basic Authentication Middleware
Use Cases
Best For
- Adding HTTP Basic Authentication to Slim Framework applications
- Protecting API endpoints with username/password credentials
- Implementing simple authentication in Zend Expressive projects
- Securing admin panels or internal tools with basic auth
- Testing authentication flows during development
- Integrating custom authentication logic via PDO or callables
Not Ideal For
- Applications requiring modern authentication like OAuth2 or JWT tokens
- Projects needing full user management with registration and password reset
- High-traffic APIs where token-based authentication is preferred for performance
- Environments where PSR-7/PSR-15 compatibility is not available or desired
Pros & Cons
Pros
Adheres to PSR-7 and PSR-15, ensuring seamless integration with frameworks like Slim and Zend Expressive, as highlighted in the README's compatibility examples.
Supports path-based protection, ignore rules, and custom authenticators, allowing granular control over which routes are secured without modifying core application logic.
Enforces HTTPS by default with configurable relaxed rules for development or proxy scenarios, promoting secure usage out of the box, as documented in the security section.
Provides before and after callbacks to modify requests and responses upon authentication, enabling customization like adding user attributes or headers without breaking middleware flow.
Allows credentials from hardcoded arrays, environment variables, PDO databases, or custom callables, offering versatility for different deployment and user management strategies.
Cons
Relies on HTTP Basic Authentication, which transmits credentials in plain text unless HTTPS is enforced, making it less secure for public-facing applications without proper encryption setup.
Version 3.x is not backwards compatible with 2.x, requiring careful upgrading and potential code adjustments, as noted in the README's heads-up and UPGRADING guide.
Only implements basic auth, lacking support for more advanced methods like session management or OAuth, which might necessitate additional middleware for complex applications.
Frequently Asked Questions
Related Projects
Slim JWT AuthPSR-7 and PSR-15 JWT Authentication Middleware
Slim CSRFSlim Framework CSRF protection middleware
Slim SessionA very simple session middleware for Slim Framework 2/3/4.
Slim WhoopsPHP whoops error on slim framework
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.