warp
warp copied to clipboard
Add warp::auth::basic() filter
You use it like this:
use warp::Filter;
let auth = warp::auth::basic()
.realm("access")
.allow("user", "1234");
let route = warp::any()
.map(warp::reply)
.with(auth);
#751 also implements basic authentication.
Contrary to theirs, mine:
- is very simple and limited
- returns an
impl Reply
instead of a rejection on authorization failure - uses an immutable set of authorizations
- realm is optional
I like the implementation using builder pattern and usage as a with()
filter.
Only objections are
- the user/password storage is not encrypted, therefore insecure (also not sure this should be part of warp, something that can for example authenticate against htpasswd files could/should be an extra crate)
- no way to use a custom lookup function for e.g. a user/pass database (or when used for
Bearer
auth to verify tokens)
Just an additional thought: the password comparison is not constant-time and might therefore be vulnerable to timing attacks.