You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/core/middleware/basicauth.md
+5-1Lines changed: 5 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ id: basicauth
6
6
7
7
Basic Authentication middleware for [Fiber](https://github.com/gofiber/fiber) that provides an HTTP basic authentication. It calls the next handler for valid credentials and [401 Unauthorized](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401) or a custom response for missing or invalid credentials.
8
8
9
-
The default unauthorized response includes the header `WWW-Authenticate: Basic realm="Restricted"`.
9
+
The default unauthorized response includes the header `WWW-Authenticate: Basic realm="Restricted", charset="UTF-8"` and sets `Cache-Control: no-store`.
| Next |`func(fiber.Ctx) bool`| Next defines a function to skip this middleware when returned true. |`nil`|
79
79
| Users |`map[string]string`| Users defines the allowed credentials. |`map[string]string{}`|
80
80
| Realm |`string`| Realm is a string to define the realm attribute of BasicAuth. The realm identifies the system to authenticate against and can be used by clients to save credentials. |`"Restricted"`|
81
+
| Charset |`string`| Charset sent in the `WWW-Authenticate` header, so clients know how credentials are encoded. |`"UTF-8"`|
82
+
| StorePassword |`bool`| Store the plaintext password in the context and retrieve it via `PasswordFromContext`. |`false`|
81
83
| Authorizer |`func(string, string) bool`| Authorizer defines a function to check the credentials. It will be called with a username and password and is expected to return true or false to indicate approval. |`nil`|
82
84
| Unauthorized |`fiber.Handler`| Unauthorized defines the response body for unauthorized responses. |`nil`|
Copy file name to clipboardExpand all lines: docs/core/whats_new.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -975,7 +975,7 @@ The adaptor middleware has been significantly optimized for performance and effi
975
975
976
976
### BasicAuth
977
977
978
-
The BasicAuth middleware was updated for improved robustness in parsing the Authorization header, with enhanced validation and whitespace handling. The default unauthorized response now uses a properly quoted and capitalized `WWW-Authenticate` header.
978
+
The BasicAuth middleware now validates the `Authorization` header more rigorously and sets security-focused response headers. The default challenge includes the `charset="UTF-8"` parameter and disables caching. Passwords are no longer stored in the request context by default; use the new `StorePassword` option to retain them. A `Charset` option controls the value used in the challenge header.
0 commit comments