Naive Basic Auth Middleware for Koa - First Draft

koa-naive-basic-auth-first-draft.ts

/* eslint-disable no-plusplus */
import crypto from 'crypto';

function parse(header: string | null): string | null {
  const match = (header || '').match(/^Basic (\S{3,300})$/);
  return match && Buffer.from(match[1], 'base64').toString();
}

function isEqual(s1: string | null, s2: string | null): boolean {
  return (
    s1 != null &&
    s2 != null &&
    s1.length === s2.length &&
    crypto.timingSafeEqual(Buffer.from(s1), Buffer.from(s2))
  );
}

// Haven't tested if this is timing safe
// function isEqualNaive(s1: string | null, s2: string | null): boolean {
//   if (!s1 || !s2 || s1.length !== s2.length) return false;
//   let allEqual = true;
//   for (let i = 0; i < s1.length; i++) {
//     allEqual = s1[i] === s2[i] && allEqual;
//   }
//   return allEqual;
// }

export function basicAuthMiddleware({ name, pass }: any): Function {
  const credentials = [name, pass].join(':');
  return async (ctx: any, next: any): Promise<any> => {
    const header = ctx.request.get('Authorization');
    if (isEqual(parse(header), credentials)) {
      await next();
    } else {
      ctx.status = 401;
      ctx.set('WWW-Authenticate', 'Basic');
      ctx.body = 'Access denied';
    }
  };
}