#$basicAuth

#Import

1import { $basicAuth } from "alepha/security";

#Overview

Middleware that enforces HTTP Basic Authentication on the request.

Works with request context only (HTTP). Reads the Authorization: Basic header, validates credentials using timing-safe comparison, and throws 401 if invalid.

1class DevToolsController {2  dashboard = $action({3    use: [$basicAuth({ username: "admin", password: "secret" })],4    handler: async () => { ... },5  });6}

An empty password is refused when the middleware is declared, with an AlephaError. It would admit anyone who sends the username with no password, and the usual way to get one is an unset variable read as password: this.env.SECRET ?? "": the gate then fails open, silently, exactly when its configuration is missing. Refusing at declaration makes that app fail to start instead.

#Options