Files
main.tsmain
What you'll learn
- Guard a path prefix with basicAuth({ username, password, realm }) and read the 401 and WWW-Authenticate challenge a browser reacts to
- Check credentials your own way with verifyUser, and answer refusals with your own message
- Hand the authenticated user to the handler with onAuthSuccess and c.set()
Press Run tests to start the app. Its log appears here.Graded endpoints
Nothing guards /cats: the list is public
The middleware answers 401 itself, with the challenge header a browser turns into a login prompt; the handler never runs
admin:nope, base64-encoded: refused the same way
admin:secret, base64-encoded: the middleware calls next() and the handler answers
The route-level guard uses verifyUser and a JSON invalidUserMessage, under the default realm
grace:kittens is in the keepers list; onAuthSuccess stored the name and the handler answers with it
Past the guard, the handler's own 404
Authentication is not authorisation: a keeper may sign in and still be refused by the handler
Luna is gone, Tom stays