authenticateBasicPF

Wraps the inner route with Http Basic authentication support using a given AuthenticatorPF<T>.

Description

Provides support for handling HTTP Basic Authentication.

Refer to authenticateBasic for a detailed description of this directive.

Its semantics are equivalent to authenticateBasicPF ’s, where not handling a case in the Partial Function (PF) leaves the request to be rejected with a AuthenticationFailedRejection rejection.

Longer-running authentication tasks (like looking up credentials in a database) should use authenticateBasicAsync or authenticateBasicPFAsync if you prefer to use the PartialFunction syntax.

See Credentials and password timing attacks for details about verifying the secret.

Example

final PartialFunction<Optional<ProvidedCredentials>, String> myUserPassAuthenticator =
  new JavaPartialFunction<Optional<ProvidedCredentials>, String>() {
    @Override
    public String apply(Optional<ProvidedCredentials> opt, boolean isCheck) throws Exception {
      if (opt.filter(c -> (c != null) && c.verify("p4ssw0rd")).isPresent()) {
        if (isCheck) return null;
        else return opt.get().identifier();
      } else if (opt.filter(c -> (c != null) && c.verify("p4ssw0rd-special")).isPresent()) {
        if (isCheck) return null;
        else return opt.get().identifier() + "-admin";
      } else {
        throw noMatch();
      }
    }
  };

final Route route = path("secured", () ->
  authenticateBasicPF("secure site", myUserPassAuthenticator, userName ->
    complete("The user is '" + userName + "'")
  )
).seal(system(), materializer());

// tests:
testRoute(route).run(HttpRequest.GET("/secured"))
  .assertStatusCode(StatusCodes.UNAUTHORIZED)
  .assertEntity("The resource requires authentication, which was not supplied with the request")
  .assertHeaderExists("WWW-Authenticate", "Basic realm=\"secure site\",charset=UTF-8");

final HttpCredentials validCredentials =
  BasicHttpCredentials.createBasicHttpCredentials("John", "p4ssw0rd");
testRoute(route).run(HttpRequest.GET("/secured").addCredentials(validCredentials))
  .assertEntity("The user is 'John'");

final HttpCredentials validAdminCredentials =
  BasicHttpCredentials.createBasicHttpCredentials("John", "p4ssw0rd-special");
testRoute(route).run(HttpRequest.GET("/secured").addCredentials(validAdminCredentials))
  .assertEntity("The user is 'John-admin'");

final HttpCredentials invalidCredentials =
  BasicHttpCredentials.createBasicHttpCredentials("Peter", "pan");
testRoute(route).run(HttpRequest.GET("/secured").addCredentials(invalidCredentials))
  .assertStatusCode(StatusCodes.UNAUTHORIZED)
  .assertEntity("The supplied authentication is invalid")
  .assertHeaderExists("WWW-Authenticate", "Basic realm=\"secure site\",charset=UTF-8");