[Slim] Add Basic authentication middleware

[ybelenko]

PR checklist

• Read the contribution guidelines.
• Ran the shell script under ./bin/ to update Petstore sample so that CIs can verify the change. (For instance, only need to run ./bin/{LANG}-petstore.sh and ./bin/security/{LANG}-petstore.sh if updating the {LANG} (e.g. php, ruby, python, etc) code generator or {LANG} client's mustache templates). Windows batch files can be found in .\bin\windows\.
• Filed the PR against the correct branch: master, 3.1.x, 4.0.x. Default: master.
• Copied the technical committee to review the pull request if your PR is targeting a particular programming language.

Description of the PR

Basic auth middleware verifies token from Authorization header.
If token not verified it returns 401 http status code and quits script execution.
User needs to implement verifyCredentials method in AuthBasic.php. By default this method always returns false to avoid security holes on production. My code swapped with tuupola/slim-basic-auth package.
For a quick start, user needs to implement own authenticator in SlimRouter class:

$basicAuth = new HttpBasicAuthentication([
    "secure" => false,
    "authenticator" => function ($arguments) {
        $user = $arguments["user"];
        $password = $arguments["password"];
        // write your own code here, compare credentials with database etc.
        return false;
    }
]);

Test endpoint with Basic auth:

$ curl -X POST "http://petstore.swagger.io:80/v2/fake" \
    -H "accept: application/json" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "number=33&double=68.9&pattern_without_delimiter=FooBar&byte=fdfdfdf" -i

Output:

HTTP/1.1 401 Unauthorized
Date: Tue, 24 Jul 2018 08:54:42 GMT
Server: Apache/2.4.23 (Win64) PHP/7.2.7
X-Powered-By: PHP/7.2.7
WWW-Authenticate: Basic realm="Protected"
Content-Length: 0

cc @jebentier @dkarlovi @mandrean @jfastnacht @ackintosh

[ybelenko]

At the last moment I've found slim-basic-auth package.
Obviously this package more stable than my script, but I've noticed few disadvantages:

1. Big dependency list
2. Hardcoded 401 response when credentials doesn't match
3. Too many settings
4. Plugin allows unsecure connection for only relaxed hosts
5. We need two more middlewares(ApiKey, OAuth) and I don't think that existen plugins will follow same code patterns as described one.

[ybelenko]

@wing328 @ackintosh One more thing. If we use 3rd party package then user have only settings without access to middleware source files. I'm still thinking what approach I should use.

[wing328]

If we use 3rd party package then user have only settings without access to middleware source files

Normally users shouldn't need to modify the source code of slim-basic-auth (or other PHP libs). If slim-basic-auth fails to meet their requirement somehow, I would suggest opening an issue instead as slim-basic-auth is pretty active and likely the owners of slim-basic-auth can address that.

Here are my feedback (although I've not played with slim-basic-auth before):

• Big dependency list (If we're doing it ourselves, we may end up having a big dependency list as we cater more and more use cases. Anyway, please open an issue ot see if the dependency list can be further trimmed down)
• Hardcoded 401 response when credentials doesn't match (To me 401 seems a reasonable default but please share with slim-basic-auth team if there are other response code you want to use by providing the details of your use case)
• Too many settings (depends on how we look at it - users may find these settings useful in their use/edge cases)
• Plugin allows unsecure connection for only relaxed hosts (please open an issue to share your feedback)
• We need two more middlewares(ApiKey, OAuth) and I don't think that existen plugins will follow same code patterns as described one (I'm ok with that as I've not seen any API that needs both HTTP basic auth and APIKey/OAuth at the same time)

[ybelenko]

I can remove revert commits and wipe off custom implementation from history if needed.

[wing328]

@ybelenko I believe the double forward slash won't cause any issue. Please correct me if I'm wrong.

[ybelenko]

Hmmm, and what are benefits from double forward slash, may I ask? 😄

[wing328]

Well I do not know. I spotted the double forward slash and just asking to make sure phpunit still works fine with it.

[ybelenko]

Just checked on Win8.1, phpunit works fine. These slash changes is result of #610 . I just use {{apiSrcPath}} and {{modelSrcPath}} which defined in AbstractPhpCodegen.

[wing328]

👌

[jmini]

This PR breaks the Shippable CI build => ensure-up-to-date

[ybelenko]

@jmini Sad to hear it. Any ideas what's wrong and how to fix it?

[jmini]

@ybelenko thank you for asking, no problem.

I have run bin/utils/ensure-up-to-date and pushed corresponding commit: d8ea28e

It is now OK on master.