@@ -284,14 +284,16 @@ create a value of type `AuthHandler Request Account` using the above `lookupAcco
284284method:
285285
286286```haskell
287−-- | The auth handler wraps a function from Request -> Handler Account
288−-- we look for a Cookie and pass the value of the cookie to `lookupAccount`.
287+import Web.Cookie (parseCookies)
288+
289289authHandler :: AuthHandler Request Account
290−authHandler =
291− let handler req = case lookup "servant-auth-cookie" (requestHeaders req) of
292− Nothing -> throwError (err401 { errBody = "Missing auth header" })
293− Just authCookieKey -> lookupAccount authCookieKey
294− in mkAuthHandler handler
290+authHandler = mkAuthHandler handler
291+ where
292+ maybeToEither e = maybe (Left e) Right
293+ throw401 msg = throwError $ err401 { errBody = msg }
294+ handler req = either throw401 lookupAccount $ do
295+ cookie <- maybeToEither "Missing cookie header" $ lookup "cookie" $ requestHeaders req
296+ maybeToEither "Missing token in cookie" $ lookup "servant-auth-cookie" $ parseCookies cookie
295297```
296298
297299Let's now protect our API with our new, bespoke authentication scheme. We'll