Support BasicAuth combinator (servant 0.5 support)

[JoshuaGross]

More information here: https://haskell-servant.github.io/posts/2016-03-19-servant-0.5-release.html#basic-auth

[tommyengstrom]

Any work been done on this? I got stuck on this issue and don't know how to solve it.

[fizruk]

I think you can just use ApiKeyParams with ApiKeyHeader location and "Authorization" header name. Basic Auth is essentially API Key, except it has the key (header value) of special form:

Basic <base64 encoded username:password>

Which you might mention in the _securitySchemeDescription by simply writing "Basic access authentication" or something like that.

You might also want to automatically add possible responses: 401 Unauthorized (when authentication data is missing) and, probably (but not necessarily) 403 Forbidden (when user is authenticated, but not authorized).

[tommyengstrom]

Aha, thanks for the pointer. I was trying to generate the swagger documentation for an API that contained BasicAuth. Now I just put it outside.

[tommyengstrom]

I just realized that by putting the Authorization outside of the documented API I lose the ability to have user dependent access levels. Is there some solution for this?

[fizruk]

What do you mean by "user dependent access levels"?

[fizruk]

@tommyengstrom BTW, I'm available on IRC #servant channel if you want more live discussion!

[tommyengstrom]

What I did was to define on api, lets call it SecureAPI, without any authorization. This API I can then generate swagger documentation for without running in to the issue of the BasicAuth combinator not being supported.

Then I did someting like:
BasicAuth "realm" AuthInfo :> SecureAPI :<|> SwaggerEndpoints

... But now the I don't have the ability to restrict access with more granularity, e.g. only allowing access to information about your data.

I'll join the IRC channel after lunch.

[domenkozar]

Given that servant-auth is going to replace the old authentication I recommend closing this in favor of https://github.com/haskell-servant/servant-auth/blob/master/servant-auth-swagger/src/Servant/Auth/Swagger.hs#L45

[akhesaCaro]

Hi,
Servant-swagger will be moved into the main Servant repo (see : haskell-servant/servant#1475)
If this issue is still relevant, would it be possible for you to summit it there? : https://github.com/haskell-servant/servant/issues

Thanks in advance!