You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/core/middleware/basicauth.md
+5-3Lines changed: 5 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,9 +4,9 @@ id: basicauth
4
4
5
5
# BasicAuth
6
6
7
-
Basic Authentication middleware for [Fiber](https://github.com/gofiber/fiber) that provides HTTP basic auth. It calls the next handler for valid credentials and returns [`401 Unauthorized`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401) or a custom response for missing or invalid credentials.
7
+
Basic Authentication middleware for [Fiber](https://github.com/gofiber/fiber) that provides HTTP basic auth. It calls the next handler for valid credentials and returns [`401 Unauthorized`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401)for missing or invalid credentials, [`400 Bad Request`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400)for malformed `Authorization` headers, or [`431 Request Header Fields Too Large`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/431) when the header exceeds size limits. Credentials may omit Base64 padding as permitted by RFC 7235's `token68` syntax.
8
8
9
-
The default unauthorized response includes the header `WWW-Authenticate: Basic realm="Restricted", charset="UTF-8"`, sets `Cache-Control: no-store`, and adds a `Vary: Authorization` header.
9
+
The default unauthorized response includes the header `WWW-Authenticate: Basic realm="Restricted", charset="UTF-8"`, sets `Cache-Control: no-store`, and adds a `Vary: Authorization` header. Only the `UTF-8` charset is supported; any other value will panic.
10
10
11
11
## Signatures
12
12
@@ -98,10 +98,11 @@ Users: map[string]string{
98
98
| Next |`func(fiber.Ctx) bool`| Next defines a function to skip this middleware when it returns true. |`nil`|
| Realm |`string`| Realm is a string to define the realm attribute of BasicAuth. The realm identifies the system to authenticate against and can be used by clients to save credentials. |`"Restricted"`|
101
-
| Charset |`string`| Charset sent in the `WWW-Authenticate` header, so clients know how credentials are encoded. |`"UTF-8"`|
101
+
| Charset |`string`| Charset sent in the `WWW-Authenticate` header. Only `"UTF-8"` is supported (case-insensitive). |`"UTF-8"`|
102
102
| HeaderLimit |`int`| Maximum allowed length of the `Authorization` header. Requests exceeding this limit are rejected. |`8192`|
103
103
| Authorizer |`func(string, string, fiber.Ctx) bool`| Authorizer defines a function to check the credentials. It will be called with a username, password, and the current context and is expected to return true or false to indicate approval. |`nil`|
104
104
| Unauthorized |`fiber.Handler`| Unauthorized defines the response body for unauthorized responses. |`nil`|
105
+
| BadRequest |`fiber.Handler`| BadRequest defines the response for malformed `Authorization` headers. |`nil`|
0 commit comments