Registry / auth-security / simple-auth-basic

simple-auth-basic

library2.0.8jsnpmunverified

simple-auth-basic is a lightweight Node.js module designed for parsing HTTP Basic Authorization headers. It extracts the username and password from the 'Authorization' header in an incoming request or a raw header string, returning an object with `name` and `pass` properties. If the header is invalid or missing, it returns `undefined`. The current stable version is 2.0.8. As a focused utility for a well-established standard, its release cadence is generally slow, primarily for maintenance and compatibility updates rather than new features. Its key differentiator is its simplicity and singular focus on parsing the header, leaving credential validation to the application logic, often paired with a timing-safe string comparison library like `tsscmp` for security.

auth-security http-networking

package ↗

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

While the README shows CJS `require()`, modern Node.js applications should prefer ESM `import`. This package should be compatible with both.

import auth from 'simple-auth-basic'

The `parse` function is a method on the default export, not a named export itself.

import auth from 'simple-auth-basic'; auth.parse(headerString)

Demonstrates setting up a basic Node.js HTTP server that uses simple-auth-basic to parse Authorization headers and perform credential validation. It includes an example of using `tsscmp` for secure password comparison.

import http from 'http'; import auth from 'simple-auth-basic'; import compare from 'tsscmp'; // Often used for timing-safe comparisons const server = http.createServer((req, res) => { const credentials = auth(req); // Basic function to validate credentials (against a user store in real apps) function check (name, pass) { let valid = true; // Using tsscmp to prevent timing attacks valid = compare(name, 'john') && valid; valid = compare(compare(pass, 'secret') && valid); return valid; } if (!credentials || !check(credentials.name, credentials.pass)) { res.statusCode = 401; res.setHeader('WWW-Authenticate', 'Basic realm="Secure Area"'); res.end('Access denied'); } else { res.end(`Welcome, ${credentials.name}! Access granted.`); } }); const port = 3000; server.listen(port, () => { console.log(`Server listening on http://localhost:${port}`); console.log('Try accessing with "john:secret" basic auth.'); });

Debug

Known footguns

gotchaThis module only parses the Basic Authorization header. It does not perform any credential validation or database lookups. Developers must implement their own logic for checking usernames and passwords, preferably using timing-safe comparison methods to prevent timing attacks.

gotchaThe `auth(req)` function expects a standard Node.js HTTP request object. When parsing a header string from other sources (e.g., a custom proxy header or a non-Node.js environment), use `auth.parse(string)` instead.

Upgrade

Version history

Breaking-change detection hasn't run for this library yet.

Audit

Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity

13 hits · last 30 days

gptbot

ahrefsbot

amazonbot

script

Resources

packagehttps://www.npmjs.com/package/simple-auth-basic ↗