Servant.Auth.Server

A JSON Web Token (JWT) in the Authorization header:

Authorization: Bearer <token>

Note that while the token is signed, it is not encrypted. Therefore do not keep in it any information you would not like the client to know.

JWTs are described in IETF's RFC 7519

How to decode data from a JWT.

The default implementation assumes the data is stored in the unregistered dat claim, and uses the FromJSON instance to decode value from there.

How to encode data from a JWT.

The default implementation stores data in the unregistered dat claim, and uses the type's ToJSON instance to encode the data.

JWTSettings are used to generate cookies, and to verify JWTs.

A JWTSettings where the audience always matches.

A JWT AuthCheck. You likely won't need to use this directly unless you are protecting a Raw endpoint.

A cookie. The content cookie itself is a JWT. Another cookie is also used, the contents of which are expected to be send back to the server in a header, for XSRF protection.

The policies to use when generating cookies.

If *both* cookieMaxAge and cookieExpires are Nothing, browsers will treat the cookie as a *session cookie*. These will be deleted when the browser is closed.

Note that having the setting Secure may cause testing failures if you are not testing over HTTPS.

The policies to use when generating and verifying XSRF cookies

Makes a cookie with session information.

Makes a cookie to be used for XSRF.

Alias for makeXsrfCookie.

Alias for makeSessionCookie.

Alias for makeSessionCookieBS.

For a JWT-serializable session, returns a function that decorates a provided response object with XSRF and session cookies. This should be used when a user successfully authenticates with credentials.

Adds headers to a response that clears all session cookies | using max-age and expires cookie attributes.

Was this request made over an SSL connection?

Note that this value will not tell you if the client originally made this request over SSL, but rather whether the current connection is SSL. The distinction lies with reverse proxies. In many cases, the client will connect to a load balancer over SSL, but connect to the WAI handler without SSL. In such a case, the handlers would get NotSecure, but from a user perspective, there is a secure connection.

Basic Auth.

A type holding the configuration for Basic Authentication. It is defined as a type family with no arguments, so that it can be instantiated to whatever type you need to authenticate your users (use type instance BasicAuthCfg = ...).

Note that the instantiation is application-wide, i.e. there can be only one instance. As a consequence, it should not be instantiated in a library.

Basic Authentication expects an element of type BasicAuthCfg to be in the Context; that element is then passed automatically to the instance of FromBasicAuthData together with the authentication data obtained from the client.

If you do not need a configuration for Basic Authentication, you can use just BasicAuthCfg = (), and recall to also add () to the Context. A basic but more interesting example is to take as BasicAuthCfg a list of authorised username/password pairs:

deriving instance Eq BasicAuthData
type instance BasicAuthCfg = [BasicAuthData]
instance FromBasicAuthData User where
  fromBasicAuthData authData authCfg =
    if elem authData authCfg then ...

A simple datatype to hold data required to decorate a request

A ServerError that asks the client to authenticate via Basic Authentication, should be invoked by an application whenever appropriate. The argument is the realm.

A class for types with a default value.

Data type representing the key-value pair to use for a cookie, as well as configuration options for it.

Creating a SetCookie

SetCookie does not export a constructor; instead, use defaultSetCookie and override values (see http://www.yesodweb.com/book/settings-types for details):

import Web.Cookie
:set -XOverloadedStrings
let cookie = defaultSetCookie { setCookieName = "cookieName", setCookieValue = "cookieValue" }

Cookie Configuration

Cookies have several configuration options; a brief summary of each option is given below. For more information, see RFC 6265 or Wikipedia.