xgqfrms, cnblogs, blogs

博客园 - xgqfrms

xgqfrms · 2026-09-20 · via 博客园 - xgqfrms

HTTP authentication All In One

Authorization: <type> <credentials>
Proxy-Authorization: <type> <credentials>

Authentication schemes

HTTP authentication schemes

Basic ✅
See RFC 7617, base64-encoded credentials. More information below.

Bearer ✅
See RFC 6750, bearer tokens to access OAuth 2.0-protected resources

Digest ✅
See RFC 7616. Firefox 93 and later support the SHA-256 algorithm. Previous versions only support MD5 hashing (not recommended).

HOBA
See RFC 7486, Section 3, HTTP Origin-Bound Authentication, digital-signature-based

Mutual
See RFC 8120

Negotiate / NTLM
See RFC4599

VAPID
See RFC 8292

SCRAM
See RFC 7804

AWS4-HMAC-SHA256
See AWS docs. This scheme is used for AWS3 server authentication.

Schemes can differ in security strength and in their availability in client or server software.

The "Basic" authentication scheme offers very poor security, but is widely supported and easy to set up.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication#authentication_schemes

IANA

https://www.iana.org/assignments/http-authschemes

demos

Nest.js Guard

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
import type { Request } from 'express';
import { Observable } from 'rxjs';

@Injectable()
export class ProfilesGuard implements CanActivate {
  canActivate(
    context: ExecutionContext,
  ): boolean | Promise<boolean> | Observable<boolean> {
    // const request = context.switchToHttp().getRequest();
    const request = context.switchToHttp().getRequest<Request>();
    console.log(`ProfilesGuard request: ${request?.toString()}`);
    // console.log(`ProfilesGuard request.method: ${request?.method}`);
    // console.log(`ProfilesGuard request.url: ${request?.url}`);
    // console.log(`ProfilesGuard request.body: ${JSON.stringify(request?.body)}`);
    // console.log(`ProfilesGuard request.params: ${JSON.stringify(request?.params)}`);
    // console.log(`ProfilesGuard request.query: ${JSON.stringify(request?.query)}`);
    // HTTP/1.1 403 Forbidden ✅
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/403
    // return false;
    // HTTP/1.1 201 Created ✅
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/201
    return true;
    // authorization 授权 微服务，用于注册授权
    // https://developer.mozilla.org/en-US/search?q=authorization
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Proxy-Authorization
    // authentication 身份验证 微服务，用于登录识别
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/WWW-Authenticate
    // return authenticate(request);
  }
}