

# Username + Password (Basic) Auth

The `Authorization: Basic ...` header can be used to send username and password credentials for authentication.

This page will show you how to use this type of authentication in your web app.

!!! note: Sending and storing passwords should be avoided wherever possible. Use tokens or sessions persistance to prevent the need for sending the password in every request.

## Password Authenticatable

Start by conforming your user model to the `PasswordAuthenticatable` protocol.

    import AuthProvider

    extension User: PasswordAuthenticatable { }

### Custom

If your user conforms to `Model`, all of the required methods will be implemented automatically. However, you can implement them if you want to do something custom.

    extension User: PasswordAuthenticatable {
        /// Return the user matching the supplied
        /// username and password
        static func authenticate(_: Password) throws -> Self {
            // something custom
        }

        /// The entity's hashed password used for
        /// validating against Password credentials
        /// with a PasswordVerifier
        var hashedPassword: String? {
            // something custom
        }

        /// The key under which the user's username,
        /// email, or other identifing value is stored.
        static var usernameKey: String {
            // something custom
        }

        /// The key under which the user's password
        /// is stored.
        static var passwordKey: String {
            // something custom
        }

        /// Optional password verifier to use when
        /// comparing plaintext passwords from the
        /// Authorization header to hashed passwords
        /// in the database.
        static var passwordVerifier: PasswordVerifier? {
            // some hasher
        }
    }

## Middleware

Once your model conforms to the `PasswordAuthenticatable` protocol, you can create the middleware.

    import Vapor
    import AuthProvider

    let drop = try Droplet()

    let passwordMiddleware = PasswordAuthenticationMiddleware(User.self)

    let authed = try drop.grouped(passwordMiddleware)

    try drop.run()

All routes added to the `authed` route group will be protected by the password middleware.

Seealso

If you only want to globally require the password middleware, checkout the Middleware Config section in the HTTP docs.

### Route

Now you can add a route to return the authenticated user.

    authed.get("me") { req in
        // return the authenticated user
        return try req.auth.assertAuthenticated(User.self)
    }

Call `req.user.authenticated(User.self)` to get access to the authenticated user.

## Request

Now we can make a request to our Vapor app.

    GET /me HTTP/1.1
    Authorization: Basic dmFwb3I6Zm9v

Note

`dmFwb3I6Zm9v` is "vapor:foo" base64 encoded where "vapor" is the username and "foo" is the password. This is the format of Basic authorization headers.

And we should get a response like.

    HTTP/1.1 200 OK
    Content-Type: text/plain

    Vapor