NAME
Plack::Middleware::Auth::Digest - Digest authentication
SYNOPSIS
enable "Auth::Digest", realm => "Secured", secret => "blahblahblah",
authenticator => sub {
my ($username, $env) = @_;
return $password; # for $username
};
# Or return MD5 hash of "$username:$realm:$password"
enable "Auth::Digest", realm => "Secured", secret => "blahblahblah",
password_hashed => 1,
authenticator => sub { return $password_hashed };
DESCRIPTION
Plack::Middleware::Auth::Digest is a Plack middleware component that
enables Digest authentication. Your authenticator callback is called
using two parameters: a username as a string and the PSGI $env hash.
Your callback should return a password, either as a raw password or a
hashed password.
CONFIGURATIONS
authenticator
A callback that takes a username and PSGI $env hash and returns a
password for the user, either in a plaintext password or a MD5 hash
of "username:realm:password" (quotes not included) when
password_hashed option is enabled.
password_hashed
A boolean (0 or 1) to indicate whether authenticator callback returns
passwords in a plaintext or hashed. Defaults to 0 (plaintext).
realm
A string to represent the realm. Defaults to restricted area.
secret
Server secret text string that is used to sign nonce. Required.
nonce_ttl
Time-to-live seconds to prevent replay attacks. Defaults to 60.
LIMITATIONS
This middleware expects that the application has a full access to the
headers sent by clients in PSGI environment. That is normally the case
with standalone Perl PSGI web servers such as Starman or
HTTP::Server::Simple::PSGI.
However, in a web server configuration where you can't achieve this
(i.e. using your application via Apache's mod_cgi), this middleware
does not work since your application can't know the value of
Authorization: header.
If you use Apache as a web server and CGI to run your PSGI application,
you can either a) compile Apache with
-DSECURITY_HOLE_PASS_AUTHORIZATION option, or b) use mod_rewrite to
pass the Authorization header to the application with the rewrite rule
like following.
RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
AUTHOR
Yuji Shimada <
[email protected]>
Tatsuhiko Miyagawa
COPYRIGHT
Yuji Shimada, Tatsuhiko Miyagawa 2010-
SEE ALSO
Plack::Middleware::Auth::Basic
LICENSE
This library is free software; you can redistribute it and/or modify it
under the same terms as Perl itself.
