
Security News
require(esm) Backported to Node.js 20, Paving the Way for ESM-Only Packages
require(esm) backported to Node.js 20, easing the transition to ESM-only packages and reducing complexity for developers as Node 18 nears end-of-life.
hapi-auth-basic
Advanced tools
Lead Maintainer: Matt Harrison
Basic authentication requires validating a username and password combination. The 'basic'
scheme takes the following options:
validate
- (required) a user lookup and password validation function with the signature [async] function(request, username, password, h)
where:
request
- is the hapi request object of the request which is being authenticated.username
- the username received from the client.password
- the password received from the client.h
- the response toolkit.{ isValid, credentials, response }
where:
isValid
- true
if both the username was found and the password matched, otherwise false
.credentials
- a credentials object passed back to the application in request.auth.credentials
.response
- Optional. If provided will be used immediately as a takeover response. Can be used to redirect the client, for example. Don't need to provide isValid
or credentials
if response
is providedBoom.unauthorized
errorcredentials
are only included when isValid
is true
, but there are cases when the application needs to know who tried to authenticate even when it fails (e.g. with authentication mode 'try'
).allowEmptyUsername
- (optional) if true
, allows making requests with an empty username. Defaults to false
.unauthorizedAttributes
- (optional) if set, passed directly to Boom.unauthorized if no custom err
is thrown. Useful for setting realm attribute in WWW-Authenticate header. Defaults to undefined
.const Bcrypt = require('bcrypt');
const Hapi = require('hapi');
const users = {
john: {
username: 'john',
password: '$2a$10$iqJSHD.BGr0E2IxQwYgJmeP3NvhPrXAeLSaGCj6IR/XU5QtjVu5Tm', // 'secret'
name: 'John Doe',
id: '2133d32a'
}
};
const validate = async (request, username, password, h) => {
if (username === 'help') {
return { response: h.redirect('https://hapijs.com/help') }; // custom response
}
const user = users[username];
if (!user) {
return { credentials: null, isValid: false };
}
const isValid = await Bcrypt.compare(password, user.password);
const credentials = { id: user.id, name: user.name };
return { isValid, credentials };
};
const main = async () => {
const server = Hapi.server({ port: 4000 });
await server.register(require('hapi-auth-basic'));
server.auth.strategy('simple', 'basic', { validate });
server.auth.default('simple');
server.route({
method: 'GET',
path: '/',
handler: function (request, h) {
return 'welcome';
}
});
await server.start();
return server;
};
main()
.then((server) => console.log(`Server listening on ${server.info.uri}`))
.catch((err) => {
console.error(err);
process.exit(1);
});
FAQs
Basic authentication plugin
We found that hapi-auth-basic demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
require(esm) backported to Node.js 20, easing the transition to ESM-only packages and reducing complexity for developers as Node 18 nears end-of-life.
Security News
PyPI now supports iOS and Android wheels, making it easier for Python developers to distribute mobile packages.
Security News
Create React App is officially deprecated due to React 19 issues and lack of maintenance—developers should switch to Vite or other modern alternatives.