Protect your Function with Basic Auth

When protecting your public Functions, and any sensitive data that they can expose, from unwanted requests and bad actors, it is important to consider some form of authentication to validate that only intended users are making requests. In this example, we'll be covering one of the most common forms of authentication: Basic Authentication.

If you want to learn an alternative approach, you can also see this example of using JWT for authentication.

Let's create a Function that will only accept requests with valid Basic Authentication, and reject all other traffic.

Configure your Function to require Basic Authentication

First, create a new auth Service and add a Public /basic Function using the directions above.

Delete the default contents of the Function, and paste in the code snippet provided above.

Save the Function once it contains the new code.

Next, deploy the Function by clicking on Deploy All in the Console UI.

Verify that Basic Authentication is working

We can check that authentication is working first by sending an unauthenticated request to our deployed Function. You can get the URL of your Function by clicking the Copy URL button next to the Function.

Then, using your client of choice, make a GET or POST request to your Function. It should return a 401 Unauthorized since the request contains no valid Authorization header.

curl -i -L -X POST 'https://auth-4173-dev.twil.io/basic'

Result:

$ curl -i -L -X POST 'https://auth-4173-dev.twil.io/basic'

HTTP/2 401
date: Tue, 03 Aug 2021 21:55:02 GMT
content-type: application/octet-stream
content-length: 12
www-authenticate: Basic realm="Authentication Required"
x-shenanigans: none

Unauthorized

Great! Requests are successfully being blocked from non-authenticated requests.

To make an authenticated request and get back a 200 OK, we'll need to generate and send a request with the example username and password encoded as the Authorization header credentials. Leverage one of the following methods to encode your Credentials:

Now that you have your encoded credentials, it's time to make an authenticated request to your Function by including them in the Authentication header.

Using cURL with our example credentials would look like this:

curl -i -L -X POST 'https://auth-4173-dev.twil.io/basic' \
-H 'Authorization: Basic dHdpbGlvOmFob3kh'

and the response would be:

$ curl -i -L -X POST 'https://auth-4173-dev.twil.io/basic' \
-H 'Authorization: Basic dHdpbGlvOmFob3kh'

HTTP/2 200
date: Tue, 03 Aug 2021 22:15:37 GMT
content-type: text/plain; charset=utf8
content-length: 2
x-shenanigans: none
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

OK

At this point, Basic Authentication is now working for your Function!

To make this example your own, you could experiment with:

• Instead of defining the username and password directly in your Function's code, define other secure values and store them securely as Environment Variables. You could then access them using context.USERNAME and context.PASSWORD respectively, for example.
• Take things a bit further and establish a database of authenticated users with hashed passwords. Once you've retrieved the decoded username and password from the Authorization header, perform a lookup of the user by username and validate their password using a library such as bcrypt. Your hashing secret can be a secure Environment Variable.