How to stack plack authentication handlers?

Question

I want the Plack app to try several different ways to authorize a user. In particular, check if the user is allowed authorization through the session cookie, then verify the Digest authenticity and then return to Basic.

I decided that I could just turn on a bunch of Auth handlers in the order I wanted them to be checked (Session, Digest, Basic). Unfortunately, the way that Plack :: Middleware :: Auth :: Digh and Plack :: Middleware :: Auth :: Basic both return 401 if the digest or base auth do not exist, respectively.

How is this commonly found in Plack?

Answer 1

I have no implementation, but I think I have an approach. You can do this on-line using Plack :: Middleware :: Conditional . This way it will look like this, but you will need to fill in the missing conditions / tests. I have not seen the simple / obvious way, but I suspect you could. Since you need to go through $env, you need to set / check the HTTP_ / session in the order you want, and save the state for the next handler to find out if it should be enabled or not.

use Plack::Builder;

my $app = sub {
    [ 200,
      [ "Content-Type" => "text/plain" ],
      [ "O HAI, PLAK!" ]
    ];
};

builder {
    enable "Session::Cookie";
    enable_if { my $env = shift;
                # I don't know...
            } "Auth::Digest",
                realm => "Secured", secret => "BlahBlah",
                    authenticator => sub { $_[0] eq $_[1] };
    enable_if { my $env = shift;
                # I don't know...
            } "Auth::Basic",
                authenticator => sub { $_[0] eq $_[1] };
    $app;
};

Answer 2

, , ( RFC 2617), , WWW-Authenticate Basic Digest ( Basic, , Basic).