Authentication
Implements incoming auth schemes. This is primarily meant for authentication but does include some authorization by limiting access to specific layers via JWT or custom schemes.
Description
Requests that do not comply with authentication requirements will receive a 401 Unauthorized HTTP status code.
When supplying authentication ensure you include the name parameter.
Choosing an authentication
| Goal | Authentication | Notes |
|---|---|---|
Allow every request |
Only safe behind an external authentication layer |
|
Block casual scrapers on a dev or intranet deployment |
One shared bearer token. Not true security |
|
Accept tokens issued by an identity provider |
Verifies the signature locally with a static key or a JWKS endpoint. Can limit layers and areas per token |
|
Validate API keys you already store in a database |
Looks the token up in PostgreSQL or Redis. Can set user and tenant IDs |
|
Reuse an existing login or API in your ecosystem |
Forwards credentials to an HTTP endpoint. Can set user and tenant IDs from the response |
|
Anything else |
Your own Go code interpreted with Yaegi. See Extensibility |