{"id":9549,"library":"basicauth","title":"basicauth library","description":"The `basicauth` library provides an incredibly simple implementation for HTTP Basic Authentication in Python. It focuses purely on decoding and basic verification of the 'Authorization' header. The current version is 1.0.0. The project is stable and has a low release cadence.","status":"active","version":"1.0.0","language":"en","source_language":"en","source_url":"https://github.com/rdegges/python-basicauth","tags":["authentication","http","basic-auth","web"],"install":[{"cmd":"pip install basicauth","lang":"bash","label":"Install `basicauth`"}],"dependencies":[],"imports":[{"note":"The primary function to decode a Basic Auth header.","symbol":"decode","correct":"import basicauth\nusername, password = basicauth.decode(auth_header)"},{"note":"A utility function to verify a Basic Auth header against known credentials.","symbol":"verify","correct":"import basicauth\nis_valid = basicauth.verify(auth_header, expected_username, expected_password)"}],"quickstart":{"code":"import basicauth\n\n# Example Authorization header\nauth_header_valid = 'Basic Zm9vOmJhcg==' # 'foo:bar'\nauth_header_invalid = 'Bearer eyJh...' # Not Basic Auth\nauth_header_malformed = 'Basic not_base64'\n\n# --- Decoding a Basic Auth header ---\n# Returns (username, password) or None\nusername, password = basicauth.decode(auth_header_valid)\nif username and password:\n    print(f\"Decoded (valid): Username='{username}', Password='{password}'\")\nelse:\n    print(f\"Failed to decode (valid): {username=}, {password=}\")\n\nusername_invalid, password_invalid = basicauth.decode(auth_header_invalid)\nif username_invalid is None:\n    print(f\"Decoded (invalid type, correctly None): {username_invalid=}, {password_invalid=}\")\n\nusername_malformed, password_malformed = basicauth.decode(auth_header_malformed)\nif username_malformed is None:\n    print(f\"Decoded (malformed, correctly None): {username_malformed=}, {password_malformed=}\")\n\n# --- Verifying a Basic Auth header ---\n# Returns True or False\nis_valid_auth = basicauth.verify(auth_header_valid, 'foo', 'bar')\nprint(f\"Verification (correct credentials): {is_valid_auth}\")\n\nis_invalid_auth = basicauth.verify(auth_header_valid, 'wrong', 'credentials')\nprint(f\"Verification (incorrect credentials): {is_invalid_auth}\")\n\nis_invalid_format = basicauth.verify(auth_header_invalid, 'foo', 'bar')\nprint(f\"Verification (wrong header format): {is_invalid_format}\")","lang":"python","description":"This quickstart demonstrates how to use `basicauth.decode` to extract username and password from an 'Authorization' header, and `basicauth.verify` to check credentials. It highlights handling `None` returns for invalid headers."},"warnings":[{"fix":"Always check if the result of `basicauth.decode()` is not `None` before attempting to unpack or use the returned username and password. Example: `result = basicauth.decode(header); if result: username, password = result`.","message":"The `basicauth.decode()` function returns `None` if the provided `auth_header` is malformed, not a 'Basic' type header, or cannot be base64 decoded and split. It does not raise an exception in these cases.","severity":"gotcha","affected_versions":"1.0.0"},{"fix":"Use `basicauth` to obtain the username and password, then implement your application's specific logic for user lookup, password verification (e.g., using `bcrypt` or `argon2`), and session management within your web framework's request handlers.","message":"This library is intentionally simplistic. It only handles the decoding and basic verification of HTTP Basic Auth headers. It does not provide functionality for user management, password hashing, session management, token expiry, or integration with web frameworks.","severity":"gotcha","affected_versions":"1.0.0"},{"fix":"Always pin your dependency version (e.g., `basicauth==1.0.0`) and review the changelog if upgrading to a new major version.","message":"The library is stable at version 1.0.0. While no breaking changes are known or anticipated for minor versions, be aware that any future major version increment (e.g., to 2.0.0) could introduce API changes.","severity":"breaking","affected_versions":"< 1.0.0 to 1.0.0"}],"env_vars":null,"last_verified":"2026-04-17T00:00:00.000Z","next_check":"2026-07-16T00:00:00.000Z","problems":[{"fix":"Always check if the result of `basicauth.decode()` is not `None` before attempting to unpack it. Use `if basicauth.decode(header): username, password = basicauth.decode(header)`.","cause":"Attempting to directly unpack the return value of `basicauth.decode()` when it returns `None` for an invalid or missing Basic Auth header.","error":"TypeError: cannot unpack non-iterable NoneType object"},{"fix":"Ensure you pass a string representing the HTTP 'Authorization' header (e.g., `basicauth.decode(request.headers.get('Authorization', ''))`).","cause":"Calling `basicauth.decode()` or `basicauth.verify()` without providing the required `auth_header` string argument.","error":"TypeError: decode() missing 1 required positional argument: 'auth_header'"},{"fix":"Use `basicauth` to get `username` and `password` from the incoming request's 'Authorization' header. Then, implement your own application logic to verify these credentials against your user store (database, file, etc.) and handle authenticated state within your framework's request handling pipeline.","cause":"Misunderstanding the scope of the `basicauth` library. It only decodes the header; it doesn't automatically implement the full authentication flow within a web framework (e.g., checking credentials against a database, creating sessions, or middleware).","error":"Basic authentication is not working in my Flask/Django/FastAPI application."}]}