LightningWeb.Auth (Lightning v2.19.0-pre)

View Source

Shared HTTP request authentication functions.

Validates inbound requests against WebhookAuthMethod records using API key (x-api-key header) or Basic Auth (authorization header). Used by both WebhookAuth plug (triggers) and ChannelProxyPlug (channels).

All comparisons use Plug.Crypto.secure_compare/2 to prevent timing attacks.

Summary

Functions

has_credentials?(conn)

Returns true if the request contains an x-api-key or authorization header (regardless of whether the value is correct).

valid_key?(conn, methods)

Returns true if the request's x-api-key header matches any :api-type auth method in the list.

valid_user?(conn, methods)

Returns true if the request's Basic Auth credentials match any :basic-type auth method in the list.

Functions

has_credentials?(conn)

Returns true if the request contains an x-api-key or authorization header (regardless of whether the value is correct).

valid_key?(conn, methods)

Returns true if the request's x-api-key header matches any :api-type auth method in the list.

valid_user?(conn, methods)

Returns true if the request's Basic Auth credentials match any :basic-type auth method in the list.