11# nextjs-basic-auth-middleware
22
3- Adds basic auth support to Next.js projects using the official middleware approach (with a ` _middleware ` file).
4- An alternative approach for server side rendered (SSR) pages is also available.
3+ Adds basic auth support to Next.js projects using the official middleware approach (with a ` middleware ` file).
54Options can be set on the basic auth middleware and overridden using environment variables.
65
76## Installation
@@ -67,40 +66,7 @@ You can also use the `nextBasicAuthMiddleware` function to check basic auth in a
6766
6867### Original SSR approach
6968
70- This approach only works for server side rendered pages where a request and response object are available.
71-
72- Either add it to individual pages in the ` getServerSideProps ` method:
73- ``` js
74- import { pageMiddleware } from ' nextjs-basic-auth-middleware'
75-
76- export async function getServerSideProps ({ req, res }) => {
77- pageMiddleware (req, res)
78- ...
79- }
80- ```
81-
82- Or add the middleware to the ` getInitialProps ` method of your document:
83-
84- ``` js
85- import { pageMiddleware } from ' nextjs-basic-auth-middleware'
86-
87- Document .getInitialProps = async ({ req, res }) => {
88- pageMiddleware (req, res)
89- ...
90- }
91- ```
92- > :warning : This will not work if you have pages that use static optimization, e.g. no use of ` getInitialProps ` or ` getServerSideProps `
93-
94- But this will work anywhere where there is a request and response object available (app/api routes as well).
95-
96- ### What about static pages (SSG, ISR)?
97-
98- Use the Next.js middleware approach if possible.
99-
100- Some alternatives if this approach will not work for you:
101- - For Vercel deployments you can check [ vercel-basic-auth] ( https://github.com/flawyte/vercel-basic-auth ) .
102- - For sites behind AWS CloudFront you can add a Lambda@edge function that adds authentication headers
103- - For Cloudflare you could use a Cloudflare worker that adds authentication headers
69+ Please check ` 1.0.0 ` if you want to use this, this is no longer available in version >=2
10470
10571### Setting environment variables
10672If you want to override credentials you can use the ` BASIC_AUTH_CREDENTIALS ` environment variable:
@@ -113,36 +79,16 @@ BASIC_AUTH_CREDENTIALS=user:password
11379BASIC_AUTH_CREDENTIALS=user:password| user2:password2
11480```
11581
116- Users set using environment variables will override and thus disable users set in options.
117- You can also set the paths that should (not) be checked:
118-
119- ``` sh
120- # Enables basic authentication for /pages
121- BASIC_AUTH_PATHS=/pages
122-
123- # You can set multiple paths using `;` as a delimiter
124- BASIC_AUTH_PATHS=/pages; /admin
125-
126- # Setting excluded paths work in the same way
127- BASIC_AUTH_EXCLUDE_PATHS=/api; /healthchecks
128- ```
129-
13082## API
131- ### basicAuthMiddleware ()
132- ``` basicAuthMiddleware (req: http.IncomingMessage , res: http.ServerResponse, options)```
83+ ### nextBasicAuthMiddleware ()
84+ ``` nextBasicAuthMiddleware (req: NextApiRequest , res: http.ServerResponse, options)```
13385
13486The options object can contain any of the following options:
13587
13688option | description | default value
13789------ | ----------- | -------------
138- ` realm ` | The name of the basic auth realm | ` 'Protected' `
90+ ` pathname ` | The path that the middleware redirects to | ` /api/auth `
13991` users ` | A list of users that can authenticate | ` [] `
140- ` includePaths ` | List of paths that should have protection | ` ['/'] `
141- ` excludePaths ` | List of paths that are excluded from protection | ` [] `
142-
143- > ** NOTE**
144- > The exclude paths are always excluded from protection,
145- > even if they exist in the included paths
14692
14793The user object consists of the following required fields:
14894
0 commit comments