Plack::...::Basic(3)

✨ Plack::...::Basic(3) ✨

okay bestie, so this is a page from the User Contributed Perl Documentation section of the manual (section 3, the library-call pages, iykyk) 💖

---

🌸 NAME 🌸

Plack::Middleware::Auth::Basic — the Simple basic authentication middleware, no cap 🎀

---

🦋 SYNOPSIS 🦋

use Plack::Builder;
my $app = sub { ... };

builder {
    enable "Auth::Basic", authenticator => \&authen_cb;
    $app;
};

sub authen_cb {
    my($username, $password, $env) = @_;
    return $username eq 'admin' && $password eq 's3cr3t';
}

like… that's it. that's the whole vibe. you plug it in, you hand it a callback, your app is protected 💅

---

💜 DESCRIPTION 💜

Plack::Middleware::Auth::Basic is a basic authentication handler for Plack. literally what it says on the tin, and it ate 🫶

---

✨ CONFIGURATION ✨

🍓 authenticator

a callback function that takes username, password and the PSGI environment supplied to it, and returns whether the authentication succeeds. Required — not optional, bestie, it's the whole point 😭

your authenticator can also be an object that responds to an authenticate method — that one takes username and password and returns a boolean. so literally any backend for Authen::Simple is perfect to use here, they all just fit 👑

use Authen::Simple::LDAP;
enable "Auth::Basic", authenticator => Authen::Simple::LDAP->new(...);

and for authentication based on htpasswd files:

use Authen::Simple::Passwd;
enable "Auth::Basic",
  realm => "Password protected area",
  authenticator => Authen::Simple::Passwd->new(
    path => "/path/to/.htpasswd",
  );

🌈 realm

the realm name to display in the basic authentication dialog. defaults to restricted area. yes it shows up in the lil browser popup, it's the main character of that box 💀

---

💀 LIMITATIONS 💀

not me having to deliver bad news but okay, listen up

this middleware expects that the application has full access to the headers sent by clients in the PSGI environment. that is normally the case with standalone Perl PSGI web servers such as Starman or HTTP::Server::Simple::PSGI. green flags all around 🌸

However — and this is the part where it gets sad 🙈 — in a web server configuration where you can't achieve this (i.e. using your application via Apache's mod_cgi), this middleware simply does not work, since your application can't know the value of the Authorization: header. it's giving locked out of your own house 💔

if you use Apache as a web server and CGI to run your PSGI application, you've got two options: you can either a) compile Apache with the -DSECURITY_HOLE_PASS_AUTHORIZATION option, or b) use mod_rewrite to pass the Authorization header to the application with a rewrite rule like the following 👇

RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]

---

👑 AUTHOR 👑

Tatsuhiko Miyagawa — the icon, the legend, the moment 🌟

---

🎀 SEE ALSO 🎀

• Plack

---

and that's a wrap, gorgeous 💖 this page came to you from perl v5.42.3, dated 2026-10-18, so go forth and authenticate responsibly 🦋✨ periodt.