.htpasswd Basic Authentication for ZIET Now serverless functions

ZEIT/Now .htpasswd Example

.htpasswd protection using a Golang serverless function

About

Is it possible to secure a domain with .htpasswd on my zeit.co website?

The creation of this project was prompted by the above question by Yannick Wittwer on the Zeir Spectrum chat. Initially I didn't think it was possible but upon further reflection and a number of failed tests I got this working example completed.

As of writing there is an open PR written on 10th July 2019 that aims to add auth config options in the ZEIT Now static config. If that gets merged in then it may make solutions such as this obsolete (more so than .htpasswd is already.)

This is a basic example and has potential for expansion; I have released it under the MIT License and look forward to seeing if and how it gets used.

How it works

This works by utilising a catch all route that tells ZEIT Now to pipe all incoming requests to default.go . The now.json contains build config for converting default.go into a serverless function that configures ZEIT Now through use of the advanced includeFiles config option to copy the content of the protected directory and the .htpasswd file into the environment the serverless function executes.

Example

I have this example live to test here . Use the username test with the password pa$$word to gain access.

Not Invented Here

flawyte/now-basic-auth beat me to the punch with their Node based implemention of Basic Authentication . They don't support loading the user credentials from a .htpasswd file but have otherwise solved the problem in the same way I did.

License

MIT