Given a public key, generate a middleware that will extract a biscuit token from incoming requests, parse it, and verify its signature. Requests without a verified biscuit are rejected, and the verified biscuit is added to the request context. The token is not authorized, only parsed and has its signature verified. Authorization is meant to be carried out in the application itself. If you want to carry out authorization in the middleware, have a look at authorizeBiscuit' (or authorizeBiscuitWith).

The token is expected as a base64-encoded string, provided as a bearer token in the Authorization header. A missing header results in a bodyless 401 HTTP response. An invalid token results in a bodyless 403 HTTP response. Errors are logged to stdout.

If you need custom extraction, parsing or error handling, have a look at parseBiscuitWith.

Retrieve the parsed token from the request context. It is meant to be used in conjunction with the parseBiscuit (or parseBiscuitWith) middleware. It will not be set by the authorizeBiscuit' (or authorizeBiscuitWith) middleware.

Given a way to extract a token from a request, parse it, and handle errors, generate a middleware that will extract a biscuit token from incoming requests, parse it, and verify its signature. Requests without a verified biscuit are rejected, and the verified biscuit is added to the request context. The token is not authorized, only parsed and has its signature verified. Authorization is meant to be carried out in the application itself. If you want to carry out authorization in the middleware, have a look at authorizeBiscuit' (or authorizeBiscuitWith).

If you don’t need custom extraction, parsing or error handling logic, have a look at parseBiscuit.

Configuration for parseBiscuitWith.

Default behaviour for token extraction and parsing.

• Extract the token as a bearer token from the Authorization header;
• Parse the token as URL-safe base64 strings, using the provided public key;
• Errors are logged to stdout;
• Missing tokens are rejected with a bodyless 401 HTTP response;
• Parsing errors are rejected with a bodyless 403 HTTP response.

Given a public key and a way to generate an authorizer from a request, generate a middleware that will extract a biscuit token from incoming requests, parse it, verify its signature and authorize it. Requests without an authorized biscuit are rejected, and the authorized biscuit is added to the request context. The underlying application will only receive requests where the whole authorization process succeeded. If you want to only parse tokens and delegate actual authorization to the underlying application, have a look at parseBiscuit (or parseBiscuitWith).

The token is expected as a base64-encoded string, provided as a bearer token in the Authorization header. A missing header results in a bodyless 401 HTTP response. An invalid token results in a bodyless 403 HTTP response. A failed authorization process results in a bodyless 403 HTTP response. Errors are logged to stdout.

If you need custom extraction, parsing, authorization or error handling, have a look at authorizeBiscuitWith.

Retrieve the result of the successful authorization from the request context. It is meant to be used in conjunction with the authorizeBiscuit' (or the authorizeBiscuitWith) middleware.

Given a way to extract a token from a request, parse it, authorized it and handle errors, generate a middleware that will extract a biscuit token from incoming requests, parse it, verify its signature and authorize it. Requests without an authorized biscuit are rejected, and the authorized biscuit is added to the request context. The underlying application will only receive requests where the whole authorization process succeeded. If you want to only parse tokens and delegate actual authorization to the underlying application, have a look at parseBiscuit (or parseBiscuitWith).

If you don’t need custom extraction, parsing, authorization, or error handling logic, have a look at authorizeBiscuit'.

Configuration for authorizeBiscuitWith.

Default behaviour for token extraction, parsing and authorization.

• Extract the token as a bearer token from the Authorization header;
• Parse the token as URL-safe base64 strings, using the provided public key;
• Authorize the request with the generated authorizer;
• Errors are logged to stdout;
• Missing tokens are rejected with a bodyless 401 HTTP response;
• Parsing errors are rejected with a bodyless 403 HTTP response.
• Authorization errors are rejected with a bodyless 403 HTTP response.

Extract a token from the Authorization header, stripping the Bearer prefix.

Generate HTTP responses based on authorization errors. Errors are logged to stdout.

• Missing tokens result in a 401 bodyless response;
• Parsing errors result in a 403 bodyless response;
• Authorization errors result in a 403 bodyless response.