HTTP Authentication in Scala with Http4s: Passwords, Digests, Sessions, JWTs

blog post: blog.rockthejv...
Full Stack Scala course: rockthejvm.com...
This long-form video will teach you how to implement HTTP authentication and authorization in Scala with http4s. You will learn how to
- use usernames and passwords with basic credentials in HTTP
- use digests for hashing passwords
- use session cookies so that a browser can maintain a logged-in state
- use JSON Web Tokens (JWTs) to manage authorization and flexible capabilities (e.g. permissions) to your server
Everything is written from scratch with Scala and http4s, a Typelevel library.
Follow Rock the JVM on:
LinkedIn: / rockthejvm
Twitter: / rockthejvm
Blog: Blog: blog.rockthejv...
-------------------------------------------------------------------------
Home: rockthejvm.com
-------------------------------------------------------------------------

[@yuri4n]

This is the kind of content our community, more often than not, completely lacks. Thank you, Daniel, for your huge contribution to Scala's learning ecosystem.

[@rrr_land]

Long time no see.
Glad to hear you again :)

[@arminkeyvanloo1151]

I can't thank you enough Daniel!
The jwt part (~56min+) is exactly what I needed because http4s-jwt-auth lib is a bit thin on documentation.

[@MrDejvidkit]

Yes this is THE content that we need!

[@jaymartinez311]

it’s funny, this looks similar to the phoenix framework when dealing with routes. I just couldn’t understand elixir very well without types. So this library seems very intriguing to me. I’m not to sure how the type level stack would do in terms of performance though in the frontend. So I’d probably use something else but I’ll checkout the course. Scala looks amazing but it’s kinda scary when you look at a large codebase.

[@MrDejvidkit]

I deal with large Scala codebase and its preety awesome.

[@benkio]

Chapters
00:00 Intro
01:32 Http Server setup
07:00 Basic Authentication
22:40 Digest Authentication
34:00 Sessions
56:45 JWT
01:18:00 Outro

[@mardukvassili]

I think there is something wrong with the Session and cookie code. If I execute the suggested curl command with a wrong cookie parameter value, I'm always passing through the endpoint. Is this the correct behaviour? Shouldn't I be blocked?

[@paulfunigga]

So much complicated stuff for a simple app :D
But thanks for enlightening Daniel.

[@hokko6475]

I have a question about the authstore, as it uses MD5 and we cannot extend the AuthStore Trait as it is sealed in the package. In the database we are using plaintext passwords, which for any real usecase is a no go. How can I use hashing for the passwords and where would I generate the hash (SHA-256 for example) for the password that's coming from the request? I've been trying to find it myself but am unable.
Also: are you going to come out with a course on HTTP4S?

[@rockthejvm]

Yes: rockthejvm.com/p/typelevel-rite-of-passage
In the course I use an external library (tsec-jwt) where you can control the algorithm (and we have SHA-256 in the course). Docs on how to do that here: jmcardon.github.io/tsec/docs/http4s-auth.html