Yesod - password protection site

Question

I am trying to set up an intermediate instance of my yesod web server, and I was wondering if there is an easy way to make the whole site password secure. In particular, I want to be able to request those who went to my site to get credentials. After authentication, it should function as a typical site. But if they cannot authenticate, they should not see anything.

Answer 1

To extend the answer to @MichaelSnoyman, here is how I applied the WAI HTTP Auth middleware:

From the forest site I went to Application.hs, which already installed some middleware for logging, for example:

makeApplication :: AppConfig DefaultEnv Extra -> IO Application
makeApplication conf = do
    foundation <- makeFoundation conf

    -- Initialize the logging middleware
    logWare <- mkRequestLogger def
        { outputFormat =
            if development
                then Detailed True
                else Apache FromSocket
        , destination = RequestLogger.Logger $ loggerSet $ appLogger foundation
        }

    -- Create the WAI application and apply middlewares
    app <- toWaiAppPlain foundation
    return $ logWare app

To add HTTP authentication, I referenced the Yesod book in the WAI section and the HttpAuth Documents referenced by Michael. The docs give this as an example of using the HttpAuth middleware:

basicAuth (\u p -> return $ u == "michael" && p == "mypass") "My Realm"

I was able to simply paste this in the lower right corner after applying the logging middleware:

import qualified Network.Wai.Middleware.HttpAuth as HttpAuth

makeApplication :: AppConfig DefaultEnv Extra -> IO Application
makeApplication conf = do
    foundation <- makeFoundation conf

    -- Initialize the logging middleware
    logWare <- mkRequestLogger def
        { outputFormat =
            if development
                then Detailed True
                else Apache FromSocket
        , destination = RequestLogger.Logger $ loggerSet $ appLogger foundation
        }

    -- Create the WAI application and apply middlewares
    app <- toWaiAppPlain foundation
    return $ logWare $ HttpAuth.basicAuth (\u p -> return $ u == "michael" && p == "mypass") "My Realm" $ app

Here's what Safari looks like:

This type of authentication is not suitable for ordinary users, but is great for blocking a site intended for internal use. It is also an easy way for machines (monitoring servers, scripts) to authenticate with your server.

Answer 2

http auth.

http://hackage.haskell.org/package/wai-extra-3.0.1/docs/Network-Wai-Middleware-HttpAuth.html

, .