libhttpserver/examples/basic_authentication.cpp at master · etr/libhttpserver · GitHub

History

64 lines (54 loc) · 2.41 KB

Raw

This file is part of libhttpserver

This library is free software; you can redistribute it and/or

modify it under the terms of the GNU Lesser General Public

License as published by the Free Software Foundation; either

version 2.1 of the License, or (at your option) any later version.

This library is distributed in the hope that it will be useful,

but WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public

License along with this library; if not, write to the Free Software

Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301

USA

// basic_authentication.cpp - per-request HTTP Basic auth check inside a

// lambda handler. For centralized auth that intercepts every request,

// see centralized_authentication.cpp.

// SECURITY NOTE: Credentials MUST NOT be hardcoded in source code (CWE-798).

// This example loads BASIC_USER and BASIC_PASS from environment variables.

// Never reflect the password in the response body.

// Usage:

// export BASIC_USER=myuser BASIC_PASS=mysecretpassword

// ./basic_authentication

// curl -u myuser:mysecretpassword http://localhost:8080/hello

#include <cstdlib>

#include <iostream>

#include <string>

#include <httpserver.hpp>

int main() {

const char* expected_user = std::getenv("BASIC_USER");

const char* expected_pass = std::getenv("BASIC_PASS");

if (!expected_user || !expected_pass) {

std::cerr << "basic_authentication: BASIC_USER and BASIC_PASS "

"environment variables must be set.\n";

return 1;

}

httpserver::webserver ws{httpserver::create_webserver(8080)};

ws.on_get("/hello", [expected_user, expected_pass]

(const httpserver::http_request& req) {

if (req.get_user() != expected_user || req.get_pass() != expected_pass) {

return httpserver::http_response::unauthorized(

"Basic", "test@example.com", "FAIL");

}

// Only echo the username — never reflect the password back to the client.

return httpserver::http_response::string(

"Hello, " + std::string(req.get_user()) + "!");

});

ws.start(true);

return 0;

}

libhttpserver/examples/basic_authentication.cpp at master · etr/libhttpserver · GitHub

Uh oh!

Expand file tree

Breadcrumbs

basic_authentication.cpp

Latest commit

History

Breadcrumbs

basic_authentication.cpp

File metadata and controls