Skip to main content

Abstract Class: BaseAuthBasicRoute<U, S, A>

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:52

Authenticates a user via HTTP Basic (RFC 7617) against their stored password/app-password secrets. This is the route a downstream service with no interactive UI - e.g. a mail server validating a legacy mail client's credentials against this authorization server - would call.

An account with requireMFA set cannot complete a real password login here (Basic auth has no way to prompt for a second factor), UNLESS the submitted value matches one of the account's own app-password secrets (see SecretType.APP_PASSWORD, BaseSecretRoute.validateAppPasswordCreate()). That bypass is the entire point of app passwords: a standing, individually-revocable, high-entropy credential the user explicitly creates for one Basic-auth-only client that can't do MFA, so enabling that one client doesn't require disabling MFA for the account as a whole. A real password remains subject to requireMFA here exactly as before - the bypass only ever applies to an app-password secret.

Extended by​

Type Parameters​

U​

U extends User

S​

S extends Secret

A​

A extends Alias

Constructors​

Constructor​

new BaseAuthBasicRoute<U, S, A>(): BaseAuthBasicRoute<U, S, A>

Returns​

BaseAuthBasicRoute<U, S, A>

Properties​

aliasClass​

abstract protected aliasClass: any

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:53

appPasswordEnabled​

protected appPasswordEnabled: boolean = true

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:69

Set to false to disable the app-password bypass below deployment-wide. An already-created app password stops authenticating (falling through to the normal requireMFA/password checks, which then reject it since it isn't a password-type secret) but is not deleted - re-enabling this restores it exactly as it was. See BaseSecretRoute.appPasswordEnabled, which independently gates creating new app passwords - the two are meant to be kept in sync, but this route reads its own copy of the config so authentication doesn't depend on BaseSecretRoute being mounted.

auditLogUtils?​

protected optional auditLogUtils?: AuditLogUtils

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:72

authMiddleware?​

protected optional authMiddleware?: AuthMiddleware

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:75

defaultScopes​

protected defaultScopes: string[] = []

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:78

jwtConfig?​

protected optional jwtConfig?: any

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:81

logger​

protected logger: any

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:84

passwordConfig​

protected passwordConfig: PasswordConfig

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:87

rateLimiter?​

protected optional rateLimiter?: RateLimiter

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:90

secretClass​

abstract protected secretClass: any

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:54

secretRepo?​

protected optional secretRepo?: RepoUtils<S>

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:92

tokenUtils?​

protected optional tokenUtils?: TokenUtils

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:95

trustedProxies​

protected trustedProxies: string[] = []

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:98

userClass​

abstract protected userClass: any

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:55

userUtils?​

protected optional userUtils?: UserUtils<U, A>

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:100

Methods​

authenticate()​

authenticate(user, req, res): Promise<AuthResult | undefined>

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:286

Authenticates the user using HTTP Basic and returns a JSON Web Token access token to be used with future API requests.

Parameters​

user​

JWTUser

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<AuthResult | undefined>

initialize()​

protected initialize(): Promise<void>

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:106

Called on server startup to initialize the route with any defaults.

Returns​

Promise<void>