11# nextjs-basic-auth-middleware  
22
3- Adds basic auth support to Next.js projects using the official middleware approach (with a ` _middleware `  file).
4- An alternative approach for server side rendered (SSR) pages is also available.
3+ Adds basic auth support to Next.js projects using the official middleware approach (with a ` middleware `  file).
54Options can be set on the basic auth middleware and overridden using environment variables.
65
76## Installation  
@@ -67,40 +66,7 @@ You can also use the `nextBasicAuthMiddleware` function to check basic auth in a
6766
6867### Original SSR approach  
6968
70- This approach only works for server side rendered pages where a request and response object are available.
71- 
72- Either add it to individual pages in the ` getServerSideProps `  method:
73- ``` js 
74-     import  { pageMiddleware  } from  ' nextjs-basic-auth-middleware' 
75- 
76-     export  async  function  getServerSideProps ({ req, res }) => {
77-         pageMiddleware (req, res)
78-         ... 
79-     }
80- ``` 
81- 
82- Or add the middleware to the ` getInitialProps `  method of your document:
83- 
84- ``` js 
85-     import  { pageMiddleware  } from  ' nextjs-basic-auth-middleware' 
86- 
87-     Document .getInitialProps  =  async  ({ req, res }) =>  {
88-         pageMiddleware (req, res)
89-         ... 
90-     }
91- ``` 
92- >  :warning :  This will not work if you have pages that use static optimization, e.g. no use of ` getInitialProps `  or ` getServerSideProps ` 
93- 
94- But this will work anywhere where there is a request and response object available (app/api routes as well).
95- 
96- ### What about static pages (SSG, ISR)?  
97- 
98- Use the Next.js middleware approach if possible.
99- 
100- Some alternatives if this approach will not work for you:
101-  -   For Vercel deployments you can check [ vercel-basic-auth] ( https://github.com/flawyte/vercel-basic-auth ) .
102-  -   For sites behind AWS CloudFront you can add a Lambda@edge function that adds authentication headers
103-  -   For Cloudflare you could use a Cloudflare worker that adds authentication headers
69+ Please check ` 1.0.0 `  if you want to use this, this is no longer available in version >=2
10470
10571### Setting environment variables  
10672If you want to override credentials you can use the ` BASIC_AUTH_CREDENTIALS `  environment variable:
@@ -113,36 +79,16 @@ BASIC_AUTH_CREDENTIALS=user:password
11379BASIC_AUTH_CREDENTIALS=user:password| user2:password2
11480``` 
11581
116- Users set using environment variables will override and thus disable users set in options.
117- You can also set the paths that should (not) be checked:
118- 
119- ``` sh 
120- #  Enables basic authentication for /pages
121- BASIC_AUTH_PATHS=/pages
122- 
123- #  You can set multiple paths using `;` as a delimiter
124- BASIC_AUTH_PATHS=/pages; /admin
125- 
126- #  Setting excluded paths work in the same way
127- BASIC_AUTH_EXCLUDE_PATHS=/api; /healthchecks
128- ``` 
129- 
13082## API  
131- ### basicAuthMiddleware () 
132- ``` basicAuthMiddleware (req: http.IncomingMessage , res: http.ServerResponse, options)``` 
83+ ### nextBasicAuthMiddleware () 
84+ ``` nextBasicAuthMiddleware (req: NextApiRequest , res: http.ServerResponse, options)``` 
13385
13486The options object can contain any of the following options:
13587
13688option | description | default value
13789------ | ----------- | -------------
138- ` realm ` | The name of  the basic auth realm  | ` 'Protected' ` 
90+ ` pathname ` | The path that  the middleware redirects to  | ` /api/auth ` 
13991` users ` | A list of users that can authenticate | ` [] ` 
140- ` includePaths ` | List of paths that should have protection | ` ['/'] ` 
141- ` excludePaths ` | List of paths that are excluded from protection | ` [] ` 
142- 
143- >  ** NOTE** 
144- >  The exclude paths are always excluded from protection,
145- >  even if they exist in the included paths
14692
14793The user object consists of the following required fields:
14894
0 commit comments