Struct BasicAuthPlugin 

pub struct BasicAuthPlugin {
    users: HashMap<String, String>,
    realm: String,
    use_consumers: bool,
    anonymous_consumer: Option<String>,
    hide_credentials: bool,
    resources: Arc<PluginResources>,
}

Authenticates requests using HTTP Basic credentials checked against a configured username/password map and/or the consumer store.

With inline users, a matching username:password pair simply lets the request continue. With use_consumers: true, the username is resolved against the gateway’s consumers: section (their basic-auth: {username, password} credentials) and the presented password is checked against the matched consumer’s stored password; on success the consumer’s identity is attached to the request (consumer.* keys in context.message plus X-Consumer-* headers) for downstream nodes. Both sources may be enabled together — inline users are checked first. For back-compat the authenticated username is always written to context.message["user"]. On failure the request is rejected with a 401 response carrying a WWW-Authenticate: Basic challenge.

Fields

users: HashMap<String, String>

Username -> plaintext password map the credentials are checked against.

realm: String

Realm advertised in the WWW-Authenticate challenge header.

use_consumers: bool

When true, credentials are also resolved against the consumer store.

anonymous_consumer: Option<String>

Consumer attached when no credential matches (instead of rejecting).

hide_credentials: bool

When true, the Authorization header is removed before proxying.

resources: Arc<PluginResources>

Implementations

impl BasicAuthPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• users (object, optional): map of username to plaintext password.
• use_consumers (bool, default false): also resolve credentials against the gateway’s consumers: section and attach the matched consumer.
• At least one of users / use_consumers must be provided.
• realm (string, default "gateway"): realm used in the WWW-Authenticate challenge.
• anonymous_consumer (string, optional): consumer name attached when no credential matches, instead of rejecting (APISIX semantics).
• hide_credentials (bool, default false): strip the Authorization header before proxying upstream.

type: basic-auth
config:
  use_consumers: true
  realm: internal-api
  hide_credentials: true

fn reject(&self, ctx: Context) -> Result<PluginOutput, PluginExecutionError>

Builds the 401 rejection: sets a JSON error body plus the WWW-Authenticate challenge on the response and returns a PluginExecutionError (code UNAUTHORIZED) carrying the context so the graph engine routes through the error port.

fn strip_credential(&self, ctx: &mut Context)

Removes the Authorization header (per hide_credentials).

Trait Implementations

impl Plugin for BasicAuthPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.