---
name: "Plack::Middleware::Auth::Basic"
section: "3pm"
platform: "linux"
package: "libplack-perl"
version: "1.0051-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/Plack::Middleware::Auth::Basic"
---

# Plack::Middleware::Auth::Basic(3pm)

Simple basic authentication middleware

## NAME

Plack::Middleware::Auth::Basic - Simple basic authentication middleware

## SYNOPSIS

```
  use Plack::Builder;
  my $app = sub { ... };
  builder {
      enable "Auth::Basic", authenticator => \&authen_cb;
      $app;
  };
  sub authen_cb {
      my($username, $password, $env) = @_;
      return $username eq 'admin' && $password eq 's3cr3t';
  }
```

## DESCRIPTION

Plack::Middleware::Auth::Basic is a basic authentication handler for Plack.

## CONFIGURATION

- authenticator

  A callback function that takes username, password and PSGI environment supplied and returns whether the authentication succeeds. Required.

  Authenticator can also be an object that responds to `"authenticate"` method that takes username and password and returns boolean, so backends for Authen::Simple is perfect to use:

  ```
    use Authen::Simple::LDAP;
    enable "Auth::Basic", authenticator => Authen::Simple::LDAP->new(...);
  ```

- realm

  Realm name to display in the basic authentication dialog. Defaults to *restricted area*.

## LIMITATIONS

This middleware expects that the application has a full access to the headers sent by clients in PSGI environment. That is normally the case with standalone Perl PSGI web servers such as Starman or HTTP::Server::Simple::PSGI.

However, in a web server configuration where you can't achieve this (i.e. using your application via Apache's mod\_cgi), this middleware does not work since your application can't know the value of `"Authorization:"` header.

If you use Apache as a web server and CGI to run your PSGI application, you can either a) compile Apache with `"-DSECURITY_HOLE_PASS_AUTHORIZATION"` option, or b) use mod\_rewrite to pass the Authorization header to the application with the rewrite rule like following.

```
  RewriteEngine on
  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
```

## AUTHOR

Tatsuhiko Miyagawa

## SEE ALSO

Plack