Slim Basic Auth Laravel Package

Product Decisions This Supports

• Build vs. Buy: Avoid reinventing the wheel for HTTP Basic Authentication (BA) in PHP-based APIs or admin panels. This package eliminates the need to write custom middleware from scratch, reducing development time and technical debt.
• Security & Compliance: Enforce HTTPS and role-based access control (RBAC) for sensitive endpoints (e.g., /api, /admin). Supports PCI-DSS, GDPR, or internal security policies requiring authentication for data protection.
• Roadmap Priorities:
  • Phase 1: Secure admin dashboards or internal tools (e.g., /admin, /dashboard) with minimal setup.
  • Phase 2: Extend to public APIs with granular path/ignore rules (e.g., exclude /api/token for OAuth flows).
  • Phase 3: Integrate with custom auth systems (e.g., LDAP, OAuth) via the authenticator parameter.
• Use Cases:
  • Admin Panels: Protect Slim/Zend Expressive backends with BA for developers/ops.
  • API Gateways: Secure RESTful endpoints (e.g., /v1/users) while allowing public access to docs (/api-docs).
  • Legacy Systems: Migrate old PHP apps to modern frameworks (Slim/Zend) with BA as a drop-in replacement.
  • Microservices: Authenticate inter-service communication (e.g., service-to-service calls over HTTP).

When to Consider This Package

• Adopt if:
  • Your stack uses PSR-7/PSR-15 (Slim, Zend Expressive, Laminas, or custom PSR-compliant apps).
  • You need HTTP Basic Auth for simple, low-overhead authentication (not OAuth/JWT).
  • Your use case fits static credentials (e.g., admin tools) or custom auth logic (via authenticator).
  • You require path-based protection (e.g., /api/* but not /public/*).
  • Your team prioritizes speed over advanced features (e.g., no sessions, tokens, or MFA).
• Look Elsewhere if:
  • You need OAuth 2.0/OpenID Connect (use league/oauth2-server or auth0).
  • Your app requires session management (use Laravel’s built-in auth or symfony/security-bundle).
  • You’re using non-PSR frameworks (e.g., WordPress, CodeIgniter) without PSR-7 middleware support.
  • You need multi-factor authentication (MFA) or passwordless login.
  • Your team lacks PHP middleware experience (steeper learning curve than Laravel’s auth:api).
  • You’re not using HTTPS (BA sends credentials in plaintext; this package enforces HTTPS by default).

How to Pitch It (Stakeholders)

For Executives:

*"This lightweight PHP package lets us secure sensitive endpoints (e.g., admin panels, APIs) with HTTP Basic Auth in hours, not weeks. It’s battle-tested (444 GitHub stars), MIT-licensed, and integrates seamlessly with our Slim/Zend Expressive stack. By adopting it, we’ll:

• Reduce risk: Enforce HTTPS and role-based access for critical paths (e.g., /api).
• Cut costs: Avoid custom dev work (no reinventing BA middleware).
• Future-proof: Supports custom auth (LDAP, databases) via plugins.
• Comply: Meet security policies (PCI, GDPR) for data protection. Alternative: Building this in-house would take 2–3 dev weeks; this costs zero and is production-ready. The abandoned status is a red flag, but the replacement is nearly identical."*

For Engineers:

*"tuupola/slim-basic-auth is a PSR-7/PSR-15 middleware for HTTP Basic Auth with these key advantages:

• Zero config for simple cases: Just pass a users array (e.g., ["admin" => "hashed_password"]).
• Granular control:
  • Protect paths like /api but exclude /api/token.
  • Customize error responses (JSON, HTML) via the error callback.
  • Hook into auth success/failure with before/after functions.
• Security: Enforces HTTPS by default (configurable for dev/staging).
• Extensible: Replace static users with a PDO authenticator (SQL) or custom callable (LDAP, OAuth).
• Performance: Lightweight (~500 LOC), no dependencies beyond PSR-7.

Tradeoffs:

• Not for OAuth/JWT: Use this for BA only (e.g., admin tools, internal APIs).
• Abandoned but stable: Last update was 2020, but it’s a simple, well-tested middleware. The fork is a drop-in replacement.
• No sessions/tokens: If you need stateful auth, pair this with a session middleware or use Laravel’s auth system.

How to Start:

1. Install: composer require tuupola/slim-basic-auth.
2. Add to Slim/Zend:

   $app->add(new \Tuupola\Middleware\HttpBasicAuthentication([
       "path" => "/admin",
       "users" => ["admin" => password_hash("secret", PASSWORD_BCRYPT)],
   ]));
   

3. For production: Store credentials in .env or a secrets manager (never commit passwords).

Next Steps:

• Demo a protected /admin route in staging.
• Extend with a PdoAuthenticator for database-backed users.
• Compare with the fork for long-term support."*