ring-api-key-middleware/README.org

• ring-api-key-middleware
  • Features
  • Usage
    • Middleware & options
  • License

https://travis-ci.org/threatgrid/ring-api-key-middleware.png?branch=master

ring-api-key-middleware

A simple middleware to authenticate users using API Key

Features

• the function to check the validity of API Key should be provided and not part of this middleware.

Usage

Middleware & options

Use wrap-api-key-auth-fn to create an instance of the middleware, wrap your routes with it:

(defn get-auth-from-api-key [token]
    (when (= token "secret-api-key")
         {:user "user-01"
          :groups ["admin-id" "user-id"]
          :username "username"
          :group-names ["admin" "users"]
          :admin true
          :auth-type :api-key}))
(def app
     (wrap-api-key-auth-fn handler get-auth-from-api-key))

When configured like this all requests with the header:

Authorization: apiKey secret-api-key

will be modified to be passed to the handler with the new key `:api-key-info` containing:

{:user "user-01"
 :groups ["admin-id" "user-id"]
 :username "username"
 :group-names ["admin" "users"]
 :admin true}

If the header contain an Authorization header with an unknown `api-key` the request will be rejected with a 403.

Authorization: apiKey unknown-api-key

If the header contain something with another authorization kind or no authorization header like:

Authorization: Bearer something-else

Then the request will be passed to the handler without any `api-key-info`. This provide the ability for other authentication middleware to be used. Deciding what to do about authenticated or non-authenticated user is left for another middleware or to be handled by the app handler.

License

Copyright © 2015-2017 Cisco Systems Eclipse Public License v1.0