Struct BasicAuthLayer 

pub struct BasicAuthLayer<F> { /* private fields */ }

Available on crate feature auth only.

Middleware that validates HTTP Basic Auth credentials.

Issues 401 Unauthorized with WWW-Authenticate: Basic realm="Protected" when the header is absent or malformed. Issues 401 (without the challenge) when credentials are present but the validator returns false.

Passwords containing : are handled correctly (only the first : splits username from password, per RFC 7617).

Example

use rust_web_server::app::App;
use rust_web_server::auth::BasicAuthLayer;
use rust_web_server::core::New;

let app = App::new().wrap(BasicAuthLayer::new(|user, pass| {
    user == "admin" && pass == "s3cret"
}));

Implementations

impl<F> BasicAuthLayer<F>

where F: Fn(&str, &str) -> bool + Send + Sync + 'static,

pub fn new(validate: F) -> BasicAuthLayer<F>

Create a layer with a validate(username, password) -> bool closure.

impl BasicAuthLayer<Box<dyn Fn(&str, &str) -> bool + Send + Sync>>

pub fn from_htpasswd_file( path: &str, ) -> Result<BasicAuthLayer<Box<dyn Fn(&str, &str) -> bool + Send + Sync>>, String>

Create a layer that validates credentials against an htpasswd-style file, loaded once at construction time (not re-read per request).

Each non-empty, non-comment (#-prefixed) line must be username:credential, where credential is one of:

• a plain-text password (Apache’s htpasswd -p format), or
• {SHA256} followed by the base64-encoded SHA-256 digest of the password — this is rws’s own scheme, not Apache’s.

Not supported

Apache’s real {SHA} scheme (SHA-1), $apr1$ (iterated MD5), and bcrypt ($2y$/$2b$) are not supported — this crate has no third-party HTTP/crypto dependencies beyond the audited RustCrypto hash crates it already uses, and hand-rolling SHA-1/MD5/bcrypt from scratch is not a risk worth taking for a security check. A real Apache-generated htpasswd file (which defaults to bcrypt or $apr1$ in modern htpasswd versions) will not verify against this — regenerate it with htpasswd -p (plain text) or write your own {SHA256} entries, or use BasicAuthLayer::new with your own closure (e.g. backed by the bcrypt crate) if you need real Apache-hash compatibility.

Errors

Returns Err if path can’t be read.

The file is re-read when it changes (18.20.0): adding or removing a user takes effect within a second, without a restart. Several files, comma-separated, are read together (one per team, say).

Trait Implementations

impl<F> Middleware for BasicAuthLayer<F>

where F: Fn(&str, &str) -> bool + Send + Sync + 'static,

fn accepts_streamed_body( &self, _request: &Request, _connection: &ConnectionInfo, ) -> bool

Headers only: a streamed body passes through untouched.

fn handle( &self, request: &Request, connection: &ConnectionInfo, next: &dyn Application, ) -> Result<Response, String>

fn runs_inline(&self, _request: &Request, _connection: &ConnectionInfo) -> bool

true when this layer’s own work for request never blocks (in-memory state, atomics, short mutexes) — see Application::runs_inline. A WithMiddleware stack runs inline only if every layer and the inner application agree. Default false.

fn is_passthrough( &self, _request: &Request, _connection: &ConnectionInfo, ) -> bool

true when handle would do nothing for request but call next (e.g. a rate limit that isn’t configured). A WithMiddleware stack offers the inner application’s execute_async only if every layer passes the request through. Default false.

fn answers_streamed_body( &self, _request: &Request, _connection: &ConnectionInfo, ) -> bool

true when this layer answers request itself — it doesn’t call next — and reads its body as a stream (a proxy forwarding it as it arrives). The body is then streamed whatever the layers after it and the application would say. Requires accepts_streamed_body. Since 18.3.0.

fn layer_name(&self) -> &'static str

A short name for this layer, as tools that describe an app list it (Application::middleware_names): by default the type’s name without its module path or generic parameters (CacheLayer). Since 18.28.0.