You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
On seeing that header, the browser will display the prompt (`Log in, bro.`) along with a basic login form with fields for username and password. When the user submits the form, the browser will retry the request, only this time it will have the required `Authorization` HTTP header that we are looking for.
58
+
On seeing that header, the browser will display the prompt (`Admin Login Required.`) along with a basic login form with fields for username and password. When the user submits the form, the browser will retry the request, only this time it will have the required `Authorization` HTTP header that we are looking for.
57
59
58
60
### Validating credentials
59
61
@@ -74,7 +76,7 @@ function authorization() {
74
76
} else {
75
77
76
78
// ask them to login again?
77
-
this.baa('Wrong details, try again, bro.');
79
+
this.baa('Admin Login Required.');
78
80
return;
79
81
80
82
// or maybe just throw a #401 error?
@@ -86,8 +88,72 @@ function authorization() {
86
88
}
87
89
```
88
90
89
-
> Note: The browser will keep sending the `Authorization` header on subsequent requests for about 15 minutes or more, effectively keeping the user logged in (from user perspective). Downside is that, server-side, you have to re-check the credentials on every request.
91
+
### Bonus 1: Server-side caching
92
+
93
+
The browser will keep sending the `Authorization` header on subsequent requests for about 15 minutes, effectively keeping the user logged in (from user perspective). Downside is that, server-side, you have to re-check the credentials on every request. As such it's probably worth keeping a cache of validated credentials to avoid excessive database lookups, for example:
BAA doesn't make any attempt to encrypt the login details it sends via the `Authorization` HTTP header so, ideally, you should only ever use BAA over HTTPS connections.
113
+
functionhousekeeping(tick) {
114
+
if (tick %5===0) // every 5 mins clear cache
115
+
baaCache = {};
116
+
}
117
+
118
+
// add this to export.install() at top of script:
119
+
F.on('service', housekeeping)
120
+
121
+
// also add an export.uninstall() to remove the listener
122
+
export.uninstall=function() {
123
+
F.removeListener('service', housekeeping);
124
+
}
125
+
```
126
+
### Bonus 2: URI authentication
127
+
128
+
The `.baa()` method only checks request HTTP headers for credentials, it doesn't check for credentials in the URI like this:
129
+
130
+
```
131
+
https://user:password@www.example.com/
132
+
```
133
+
134
+
If you wish to accept credentials in the URI, use `.req.uri.auth`:
135
+
136
+
```javascript
137
+
functionauthorization() {
138
+
139
+
// ...
140
+
141
+
if (auth.empty) { // check for URI auth first, before asking user to login
142
+
143
+
if (this.req.uri.auth) { // found credentials on auth, use those instead
144
+
145
+
let creds =this.req.uri.auth.split(':');
146
+
auth.user= creds[0];
147
+
auth.password= creds[1];
148
+
auth.empty=false;
149
+
150
+
} else {
151
+
this.baa('Admin Login Required.'); // or whatever prompt you want the user to see
0 commit comments