olssonm/l5-very-basic-auth

Stateless HTTP basic auth without the need for a database. For Laravel 5

Laravel Very Basic Auth

![Total downloads][ico-downloads] ![Software License][ico-license] [][link-build], _(*1)

, _(*2)

Documentation available in:, _(*3)

🇬🇧 English
🇯🇵 日本語, _(*4)

This package allows you to add a HTTP Basic Auth filter on your routes, without the need to use a database – which the Laravel default auth.basic-middleware relies on., _(*5)

, _(*6)

Perfect when you want to give your clients access to your development site before you have yet to set up your database and/or models. Or perhaps your site doesn't even use a database and you still wish to keep it protected., _(*7)

On failed authentication the user will get a "401 Unauthorized" response., _(*8)

A thing to note

While HTTP Basic Auth does give you a protection layer against unwanted visitors, it is still not strictly safe from brute-force attacks. If you are solely using this package for security, you should at least consider looking into Apache or Nginx rate-limiters to limit login attempts., _(*9)

Installation

Via Composer, _(*10)

``` bash $ composer require olssonm/l5-very-basic-auth, <sub>(*11)</sub>

Since v4.* (for Laravel 5.5) this package uses Package Auto-Discovery for loading the service provider. Once installed you should see the message

Discovered Package: olssonm/l5-very-basic-auth, <sub>(*12)</sub>

If you would like to manually add the provider, turn off Auto-Discovery for the package in your composer.json-file:

``` json
"extra": {
    "laravel": {
        "dont-discover": [
            "olssonm/l5-very-basic-auth"
        ]
    }
},

And then add the provider in the providers array (config/app.php)., <sub>(*13)</sub>

``` php 'providers' => [ Olssonm\VeryBasicAuth\VeryBasicAuthServiceProvider::class ], <sub>(*14)</sub>

## Configuration

Run the command `$ php artisan vendor:publish` and select `Provider: Olssonm\VeryBasicAuth\VeryBasicAuthServiceProvider` to publish the configuration. You could also type `$ php artisan vendor:publish --provider="Olssonm\VeryBasicAuth\VeryBasicAuthServiceProvider"` to directly publish the files.

The file `very_basic_auth.php` will then be copied to your `app/config`-folder – here you can set various options such as username and password.

#### Note

**There is no default password**. Upon installation you will need to set your own username and password. Please publish the packages configuration to have the ability to set these. **If left empty, basic auth will not be active**.

### Environments

You may set the environments that the package should be applied for. You may simply use "`*`" to use in all environments (this is also the default).

``` php
'envs' => [
    '*'
],

Or, <sub>(*15)</sub>

``` php 'envs' => [ 'production', 'development', 'local' ],, <sub>(*16)</sub>

### Response handlers

When the authentication fails the response handler sends out an error response (see "Views and messages" for more about these options). By default the handler will be `\Olssonm\VeryBasicAuth\Handlers\DefaultResponseHandler` (see `response_handler` in `very_basic_auth.php`). You may however write your own response-logic if you so choose. The only requirement is that it implements the `\Olssonm\VeryBasicAuth\Handlers\ResponseHandler`-interface, and has an `__invoke`-method that accepts a request-object, like so:

``` php
use Illuminate\Http\Request;
use Olssonm\VeryBasicAuth\Handlers\ResponseHandler;

class CustomResponseHandler implements ResponseHandler
{
    public function __invoke(Request $request)
    {
        // Do some stuff
        return response('Custom response', 401);
    }
}

Views and messages

In the very_basic_auth.php-configuration you have the ability to set a custom view instead of a message., <sub>(*17)</sub>

``` php // Message to display if the user "opts out"/clicks "cancel" 'error_message' => 'You have to supply your credentials to access this resource.',, <sub>(*18)</sub>

// If you prefer to use a view with your error message you can uncomment "error_view". // This will supersede your default response message // 'error_view' => 'very_basic_auth::default', <sub>(*19)</sub>

If you uncomment `error_view`, the middleware will try to find your specified view. You supply this value as usual (without the `.blade.php`-extention).

## Usage

The middleware uses the `auth.very_basic`-filter to protect routes. You can either use `Route::group()` to protect multiple routes, or chose just to protect them individually.

**Group**
``` php
Route::group(['middleware' => 'auth.very_basic'], function() {
    Route::get('/', ['as' => 'start', 'uses' => 'StartController@index']);
    Route::get('/page', ['as' => 'page', 'uses' => 'StartController@page']);
});

Single ``` php Route::get('/', [ 'as' => 'start', 'uses' => 'StartController@index', 'middleware' => 'auth.very_basic' ]);, <sub>(*20)</sub>

You may also set the credentials inline;

``` php
Route::get('/', [
    'as' => 'start',
    'uses' => 'StartController@index',
    'middleware' => 'auth.very_basic:username,password'
]);

Note: inline credentials always take president over the very_basic_auth.php-configuration file., <sub>(*21)</sub>

Generating hash for password

If you want to generate a hash for your password, you can use the artisan-command:, <sub>(*22)</sub>

``` bash php artisan very-basic-auth:generate-password, <sub>(*23)</sub>

It will ask you for a password, and then automatically insert the hash into your `.env`-file


## Testing

``` bash
$ composer test

or, <sub>(*24)</sub>

bash $ phpunit, <sub>(*25)</sub>

Laravel always runs in the "testing" environment while running tests. Make sure that testing is set in the envs-array in very_basic_auth.php., <sub>(*26)</sub>

Thank you

A big thank you to the people who has contributed to this package, among others:, <sub>(*27)</sub>

kazuhei – for providing the awesome Japanese translation
freekmurze – for additional information on package/vendor installations
faiare – for pointing out and implementing the realm-attribute (RFC7235), <sub>(*28)</sub>

License

The MIT License (MIT). Please see License File for more information., <sub>(*29)</sub>

© 2024 Marcus Olsson., <sub>(*30)</sub>