Add docs related to auth when using Kino.Proxy

[hugobarauna]

No description provided.

[josevalim]

In this case, using bearer tokens may be the best example, since tokens are most common for APIs (and Kino.Proxy would most likely be used for APIs?)

[hugobarauna]

Indeed.

I'll change from HTTP basic auth to HTTP Bearer.

[hugobarauna]

I thought about leaving this example as simple as possible, with no auth. And the auth would be below, inside the admonition block.

[josevalim]

Oh, I see. Keeping it simple is a good idea.

[hugobarauna]

@josevalim maybe this version?

Although I'm not 100% satisfied with it. I accept suggestions.

[hugobarauna]

I thought about leaving this example as simple as possible, with no auth. And the auth would be below, inside the admonition block.

[hugobarauna]

@josevalim what about this code example with a simple Bearer auth?

Kino.Proxy.listen(fn conn ->
  api_token = "my-secret-api-token"

  with ["Bearer " <> client_token] <- Plug.Conn.get_req_header(conn, "authorization"),
       true <- api_token == client_token do
    Plug.Conn.send_resp(conn, 200, "hello")
  else
    _ ->
      conn
      |> Plug.Conn.put_resp_header("www-authenticate", "Bearer")
      |> Plug.Conn.send_resp(401, "Unauthorized")
  end
end)

[josevalim]

Kino.Proxy.listen(fn conn ->
  api_token = "my-secret-api-token"

  case Plug.Conn.get_req_header(conn, "authorization") do
    ["Bearer " <> ^api_token] ->
      Plug.Conn.send_resp(conn, 200, "hello")
    _ ->
      conn
      |> Plug.Conn.put_resp_header("www-authenticate", "Bearer")
      |> Plug.Conn.send_resp(401, "Unauthorized")
  end
end)

[josevalim]

Actually, the example above is unsafe, we want to use Plug.Crypto.secure_compare :( It may be worth keeping it as user:pass just for simplicity. Sorry for the back and forth. :(

[jonatanklosko]

@josevalim I started to wonder if we should put them in the /public namespace. The main downside is that it differs more from the base app/session path.

[josevalim]

We can always add more routes in the future. I think we have a good starting set. I can also see it being used for coordinating tasks inside their own infrastructure, but still not exposing it to the world.

[hugobarauna]

@josevalim can I merge this?

[josevalim]

@hugobarauna to merge this, you should either use Plug.BasicAuth, or keep the token aprpoach, but use Plug.Crypto.secure_compare(user_token, expected_token)., Then feel free to ship it!

[hugobarauna]

@josevalim now it should be ready to merge. Please take a last look.