git.iko.soy/typeable/servant
on master help sign in
Add basic-auth data types to servant core
6dc577caaron levin
servant/src/Servant/API.hs+4
compare with master
unifiedsplit
@@ -29,6 +29,9 @@ module Servant.API (
29 -- * Actual endpoints, distinguished by HTTP method
29 -- * Actual endpoints, distinguished by HTTP method
30 module Servant.API.Verbs,
30 module Servant.API.Verbs,
31
31
32+ -- * Authentication
33+ module Servant.API.BasicAuth,
34+
32 -- * Content Types
35 -- * Content Types
33 module Servant.API.ContentTypes,
36 module Servant.API.ContentTypes,
34 -- | Serializing and deserializing types based on @Accept@ and
37 -- | Serializing and deserializing types based on @Accept@ and
@@ -51,6 +54,7 @@ module Servant.API (
51 ) where
54 ) where
52
55
53import Servant.API.Alternative ((:<|>) (..))
56import Servant.API.Alternative ((:<|>) (..))
57+import Servant.API.BasicAuth (BasicAuth,BasicAuthData(..))
54import Servant.API.Capture (Capture)
58import Servant.API.Capture (Capture)
55import Servant.API.ContentTypes (Accept (..), FormUrlEncoded,
59import Servant.API.ContentTypes (Accept (..), FormUrlEncoded,
56 FromFormUrlEncoded (..), JSON,
60 FromFormUrlEncoded (..), JSON,
servant/src/Servant/API/BasicAuth.hsnew file+29
@@ -0,0 +1,29 @@
1+{-# LANGUAGE DataKinds #-}
2+{-# LANGUAGE DeriveDataTypeable #-}
3+{-# LANGUAGE KindSignatures #-}
4+{-# LANGUAGE PolyKinds #-}
5+module Servant.API.BasicAuth where
6+
7+import Data.ByteString (ByteString)
8+import Data.Typeable (Typeable)
9+import GHC.TypeLits (Symbol)
10+
11+
12+-- | Combinator for <https://tools.ietf.org/html/rfc2617#section-2 Basic Access Authentication>.
13+--
14+-- *IMPORTANT*: Only use Basic Auth over HTTPS! Credentials are not hashed or
15+-- encrypted. Note also that because the same credentials are sent on every
16+-- request, Basic Auth is not as secure as some alternatives. Further, the
17+-- implementation in servant-server does not protect against some types of
18+-- timing attacks.
19+--
20+-- In Basic Auth, username and password are base64-encoded and transmitted via
21+-- the @Authorization@ header. Handshakes are not required, making it
22+-- relatively efficient.
23+data BasicAuth (realm :: Symbol)
24+ deriving (Typeable)
25+
26+-- | A simple datatype to hold data required to decorate a request
27+data BasicAuthData = BasicAuthData { basicAuthUsername :: !ByteString
28+ , basicAuthPassword :: !ByteString
29+ }