basic-auth-connect

const connect = require('connect'); const basicAuth = require('basic-auth-connect'); const http = require('http'); const crypto = require('crypto'); const app = connect(); // Simulate a database user check with timing-safe comparison const users = { 'tj': 'wahoo', 'admin': 'secret' }; function verifyUser(user, pass, done) { setTimeout(() => { const storedPass = users[user]; if (storedPass) { // Crucial for security: timing-safe comparison const userBuffer = Buffer.from(pass); const storedBuffer = Buffer.from(storedPass); if (userBuffer.length === storedBuffer.length && crypto.timingSafeEqual(userBuffer, storedBuffer)) { console.log(`User '${user}' authenticated successfully.`); return done(null, user); } } console.log(`Failed authentication for user '${user}'.`); done(null, false); // Failed authentication }, 100); } // Basic auth with static username/password app.use('/protected-static', basicAuth('staticuser', 'staticpass')); // Basic auth with async callback verification app.use('/protected-async', basicAuth(verifyUser)); app.use('/protected-static', (req, res) => { res.end('Accessed protected static route!'); }); app.use('/protected-async', (req, res) => { res.end('Accessed protected async route!'); }); app.use('/', (req, res) => { res.end('Welcome! Try /protected-static or /protected-async'); }); http.createServer(app).listen(3000, () => { console.log('Server running on http://localhost:3000'); console.log('Try accessing http://localhost:3000/protected-static with staticuser/staticpass'); console.log('Try accessing http://localhost:3000/protected-async with tj/wahoo'); });