|  | @ -105,20 +105,8 @@ func (hba *HTTPBasicAuth) Provision(ctx caddy.Context) error { | 
			
		
	
		
		
			
				
					|  |  | // Authenticate validates the user credentials in req and returns the user, if valid.
 |  |  | // Authenticate validates the user credentials in req and returns the user, if valid.
 | 
			
		
	
		
		
			
				
					|  |  | func (hba HTTPBasicAuth) Authenticate(w http.ResponseWriter, req *http.Request) (User, bool, error) { |  |  | func (hba HTTPBasicAuth) Authenticate(w http.ResponseWriter, req *http.Request) (User, bool, error) { | 
			
		
	
		
		
			
				
					|  |  | 	username, plaintextPasswordStr, ok := req.BasicAuth() |  |  | 	username, plaintextPasswordStr, ok := req.BasicAuth() | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	// if basic auth is missing or invalid, prompt for credentials
 |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	if !ok { |  |  | 	if !ok { | 
			
		
	
		
		
			
				
					
					|  |  | 		// browsers show a message that says something like:
 |  |  | 		return hba.promptForCredentials(w, nil) | 
			
				
				
			
		
	
		
		
			
				
					|  |  | 		// "The website says: <realm>"
 |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		// which is kinda dumb, but whatever.
 |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		realm := hba.Realm |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		if realm == "" { |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 			realm = "restricted" |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		} |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Basic realm="%s"`, realm)) |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		return User{}, false, nil |  |  |  | 
			
		
	
		
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | 	plaintextPassword := []byte(plaintextPasswordStr) |  |  | 	plaintextPassword := []byte(plaintextPasswordStr) | 
			
		
	
	
		
		
			
				
					|  | @ -129,15 +117,27 @@ func (hba HTTPBasicAuth) Authenticate(w http.ResponseWriter, req *http.Request) | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | 	same, err := hba.Hash.Compare(account.password, plaintextPassword, account.salt) |  |  | 	same, err := hba.Hash.Compare(account.password, plaintextPassword, account.salt) | 
			
		
	
		
		
			
				
					|  |  | 	if err != nil { |  |  | 	if err != nil { | 
			
		
	
		
		
			
				
					
					|  |  | 		return User{}, false, err |  |  | 		return hba.promptForCredentials(w, err) | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 	if !same || !accountExists { |  |  | 	if !same || !accountExists { | 
			
		
	
		
		
			
				
					
					|  |  | 		return User{}, false, nil |  |  | 		return hba.promptForCredentials(w, nil) | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | 	return User{ID: username}, true, nil |  |  | 	return User{ID: username}, true, nil | 
			
		
	
		
		
			
				
					|  |  | } |  |  | } | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | func (hba HTTPBasicAuth) promptForCredentials(w http.ResponseWriter, err error) (User, bool, error) { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	// browsers show a message that says something like:
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	// "The website says: <realm>"
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	// which is kinda dumb, but whatever.
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	realm := hba.Realm | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	if realm == "" { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		realm = "restricted" | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Basic realm="%s"`, realm)) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	return User{}, false, err | 
			
		
	
		
		
			
				
					|  |  |  |  |  | } | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | // Comparer is a type that can securely compare
 |  |  | // Comparer is a type that can securely compare
 | 
			
		
	
		
		
			
				
					|  |  | // a plaintext password with a hashed password
 |  |  | // a plaintext password with a hashed password
 | 
			
		
	
		
		
			
				
					|  |  | // in constant-time. Comparers should hash the
 |  |  | // in constant-time. Comparers should hash the
 | 
			
		
	
	
		
		
			
				
					|  | 
 |