11 Membuat Middleware Basic Authentication HTTP Router pada Golang

project-root/
├── main.go
├── handlers.go
├── pkg/
│   ├── middleware/
│   │   └── auth.go
│   └── utils/
│       └── jwt.go

package main

import (
	"fmt"
	"log"
	"net/http"
	"github.com/julienschmidt/httprouter"
	"project-root/middleware"
	"project-root/handlers"
)

func main() {
	router := httprouter.New()

		// sample testing generate basic authentication
	fmt.Println("generate basic auth: " + base64.StdEncoding.EncodeToString([]byte("ihsan:password")))

	// Endpoint publik tanpa autentikasi
	router.GET("/public", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
		fmt.Fprint(w, "Endpoint publik tidak membutuhkan autentikasi!\n")
	})

	// Endpoint privat menggunakan middleware Basic Authentication
	router.GET("/private", middleware.BasicAuth(handlers.PrivateHandler))

	log.Println("Server berjalan di http://localhost:8080")
	log.Fatal(http.ListenAndServe(":8080", router))
}

package middleware

import (
	"encoding/base64"
	"net/http"
	"strings"
	"github.com/julienschmidt/httprouter"
)

var validUsers = map[string]string{
	"admin": "password123",
	"user":  "password456",
}

func BasicAuth(next httprouter.Handle) httprouter.Handle {
	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
		authHeader := r.Header.Get("Authorization")
		if authHeader == "" || !strings.HasPrefix(authHeader, "Basic ") {
			http.Error(w, "Unauthorized", http.StatusUnauthorized)
			return
		}

		// Decode Base64 dari kredensial
		payload, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(authHeader, "Basic "))
		if err != nil {
			http.Error(w, "Invalid authentication token", http.StatusUnauthorized)
			return
		}

		cred := strings.SplitN(string(payload), ":", 2)
		if len(cred) != 2 || !validateUser(cred[0], cred[1]) {
			http.Error(w, "Invalid username or password", http.StatusUnauthorized)
			return
		}

		// Lanjutkan ke handler berikutnya jika valid
		next(w, r, ps)
	}
}

func validateUser(username, password string) bool {
	if pass, ok := validUsers[username]; ok {
		return pass == password
	}
	return false
}

package midleware

import (
	"encoding/base64"
	"fmt"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/julienschmidt/httprouter"
)

func TestBasicAuth(t *testing.T) {
	type args struct {
		username string
		password string
	}
	tests := []struct {
		name           string
		args           args
		mock           func(args args) string
		wantHTTPStatus int
		wantResponse   string
	}{
		{
			name: "success valid basic authentication",
			args: args{
				username: "ihsan",
				password: "password",
			},
			mock: func(args args) string {
				return "Basic " + base64.StdEncoding.EncodeToString([]byte(args.username+":"+args.password))
			},
			wantHTTPStatus: http.StatusOK,
			wantResponse:   fmt.Sprintln("Selamat datang di endpoint private menggunakan basic authentication! Anda berhasil terautentikasi."),
		},
		{
			name: "invalid because authorization header not set",
			args: args{},
			mock: func(args args) string {
				return ""
			},
			wantHTTPStatus: http.StatusUnauthorized,
			wantResponse:   fmt.Sprintln("Unauthorized"),
		},
		{
			name: "invalid username or password",
			args: args{
				username: "santekno",
				password: "password",
			},
			mock: func(args args) string {
				return "Basic " + base64.StdEncoding.EncodeToString([]byte(args.username+":"+args.password))
			},
			wantHTTPStatus: http.StatusUnauthorized,
			wantResponse:   fmt.Sprintln("Invalid username or password"),
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			token := tt.mock(tt.args)

			// membuat request dengan header yang valid
			request := httptest.NewRequest(http.MethodGet, "/", nil)
			request.Header.Set("Authorization", token)

			// buat recorder untuk menangkap response
			recorder := httptest.NewRecorder()

			handler := BasicAuth(MockBasicAuthHandler)
			handler(recorder, request, httprouter.Params{})

			if recorder.Code != tt.wantHTTPStatus {
				t.Errorf("expected 200 ok, got %d", recorder.Code)
			}

			if !strings.Contains(recorder.Body.String(), tt.wantResponse) {
				t.Errorf("unexpected response body %s", recorder.Body.String())
			}
		})
	}
}

func MockBasicAuthHandler(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
	fmt.Fprint(w, "Selamat datang di endpoint private menggunakan basic authentication! Anda berhasil terautentikasi.\n")
}

package handlers

import (
	"fmt"
	"net/http"
	"github.com/julienschmidt/httprouter"
)

func PrivateHandler(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
	fmt.Fprint(w, "Selamat datang di endpoint privat! Anda berhasil terautentikasi.\n")
}

go run main.go

curl http://localhost:8080/public

Endpoint publik tidak membutuhkan autentikasi!

curl -H "Authorization: Basic YWRtaW46cGFzc3dvcmQxMjM=" http://localhost:8080/private