Support extending accounts to support HTTP basic auth

[mitar]

So while adding support for HTTP basic auth could be done inside a package, the issue is that not all hooks are exposed for this purpose. For example, one can call setUserId to associate user with a connection, but that does not call validateloginattempt.

One solution is to monkeypatch Package["accounts-base"].Accounts._loginUser, but the issue is that this is not a very stable approach. There might have to be a public API for it. How it would be structured?

A motivation for this is also integrating Sandstorm authentication properly, which also uses HTTP auth: sandstorm-io/meteor-accounts-sandstorm#24

[dr-dimitru]

Hello @mitar ,

We have ugly experience with HTTP authentication for GET requests from a browser.
Our main purpose was to control access to uploaded and restricted files, in terms of Meteor-Files package.

As far as I know it's impossible to add custom headers to plain GET requests from a browser (unless XHR is used). Our implementation is simply using get query parameter.

That will be great to have ability to control incoming HTTP requests in the same way as we control data flow and access permissions in Meteor.Method.

For more info see this thread and this PR where we used authentication via get query parameter.

Let me know what you think.

[mitar]

What I had in mind is more about how to set userId on the current connection based on the HTTP header (HTTP basic auth) and also call all necessary login callbacks.

[dr-dimitru]

Your idea and purpose are clear to me.
My suggestion is to extend it to cover auth on GET requests. As in case I've provided.

As far as I know - right now it's impossible, unless we use XHR, and cookies ain't silver bullet too.

Feel free to ignore my messages if my case is far beyond initial idea.