🧹 chore: Remove support for PasswordFromContext from BasicAuth middleware by gaby · Pull Request #3638 · gofiber/fiber

gaby · 2025-07-31T02:07:37Z

Summary

document Vary: Authorization header added by BasicAuth
drop support for StorePassword support and PasswordFromContext(), since they expose plain-text passwords to security issues.

coderabbitai · 2025-07-31T02:07:44Z

Walkthrough

This change removes all logic and documentation related to storing and retrieving plaintext passwords in the Fiber BasicAuth middleware context. It eliminates the StorePassword configuration, the PasswordFromContext function, and associated tests and documentation, while updating docs to reflect new response headers and the revised authentication context behavior.

Changes

Cohort / File(s)	Change Summary
Docs: BasicAuth Middleware `docs/middleware/basicauth.md`	Updated documentation to remove all references to password storage in context, the `StorePassword` option, and the `PasswordFromContext` function. Added documentation for the new `Vary: Authorization` header in unauthorized responses.
Docs: What's New & Migration `docs/whats_new.md`	Updated middleware and migration documentation to remove mention of password context storage, `StorePassword`, and `PasswordFromContext`. Added notes on the new `Vary: Authorization` header.
Middleware Implementation `middleware/basicauth/basicauth.go`	Removed all code related to password storage in context, including the `PasswordFromContext` function and associated logic. Updated comments to reflect only username storage.
Middleware Config `middleware/basicauth/config.go`	Removed the `StorePassword` field from the `Config` struct and its default initialization.
Middleware Tests `middleware/basicauth/basicauth_test.go`	Removed tests and assertions related to password storage in context, including deleting the `Test_BasicAuth_NoStorePassword` test. Updated remaining tests to only check username retrieval.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant FiberApp
    participant BasicAuthMiddleware

    Client->>FiberApp: HTTP request with Authorization header
    FiberApp->>BasicAuthMiddleware: Process request
    BasicAuthMiddleware->>BasicAuthMiddleware: Validate credentials
    alt Credentials valid
        BasicAuthMiddleware->>FiberApp: Store username in context
        FiberApp-->>Client: Respond with resource
    else Credentials invalid
        BasicAuthMiddleware-->>Client: Respond 401 with WWW-Authenticate, Cache-Control, Vary: Authorization
    end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~15 minutes

Possibly related PRs

🧹chore: Improve BasicAuth middleware default security #3522: This PR originally introduced the StorePassword option and password context storage, which are now being removed in the current changes.

Suggested labels

🧹 Updates, 📒 Documentation, v3

Suggested reviewers

sixcolors
ReneWerner87

Poem

A hop and a skip, the password is gone,
No more secrets stored as Fiber moves on.
Only usernames linger, lean and secure,
With headers that vary, responses demure.
Docs and tests tidied, code fresh as dew—
This bunny approves the changes you do! 🐇✨

Note

⚡️ Unit Test Generation is now available in beta!

Learn more here, or try it out under "Finishing Touches" below.

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c309d46 and 7e1069f.

📒 Files selected for processing (5)

docs/middleware/basicauth.md (1 hunks)
docs/whats_new.md (2 hunks)
middleware/basicauth/basicauth.go (1 hunks)
middleware/basicauth/basicauth_test.go (2 hunks)
middleware/basicauth/config.go (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

docs/**

📄 CodeRabbit Inference Engine (.github/copilot-instructions.md)

Review and update the contents of the docs folder if necessary when modifying code

Files:

docs/middleware/basicauth.md
docs/whats_new.md

🧠 Learnings (6)

📓 Common learnings

Learnt from: gaby
PR: gofiber/fiber#3193
File: middleware/cache/cache_test.go:897-897
Timestamp: 2024-11-08T04:10:42.990Z
Learning: In the Fiber framework, `Context()` is being renamed to `RequestCtx()`, and `UserContext()` to `Context()` to improve clarity and align with Go's context conventions.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-09-25T15:57:10.221Z
Learning: In the Fiber framework tests, using `ctx.Response.Header.Cookie` may not be suitable for parsing cookies from the response header, as it requires a `*Cookie` and fills it rather than returning a string value; thus, manual parsing of the `Set-Cookie` header may be necessary.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the Fiber framework tests, using `ctx.Response.Header.Cookie` may not be suitable for parsing cookies from the response header, as it requires a `*Cookie` and fills it rather than returning a string value; thus, manual parsing of the `Set-Cookie` header may be necessary.

middleware/basicauth/basicauth.go (4)

Learnt from: gaby
PR: #3193
File: middleware/cache/cache_test.go:897-897
Timestamp: 2024-11-08T04:10:42.990Z
Learning: In the Fiber framework, Context() is being renamed to RequestCtx(), and UserContext() to Context() to improve clarity and align with Go's context conventions.

Learnt from: gaby
PR: #3193
File: middleware/adaptor/adaptor.go:111-111
Timestamp: 2024-11-10T23:44:13.704Z
Learning: In the middleware/adaptor/adaptor.go file of the Fiber framework, when updating context handling, replacing c.Context() with c.RequestCtx() is appropriate to access the fasthttp.RequestCtx.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/session_manager.go:30-43
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware, session.FromContext(c) returns *session.Middleware, whereas m.session.Get(c) returns *session.Store, so they are not directly interchangeable.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/session_manager.go:30-43
Timestamp: 2024-09-25T16:15:39.392Z
Learning: In the session middleware, session.FromContext(c) returns *session.Middleware, whereas m.session.Get(c) returns *session.Store, so they are not directly interchangeable.

docs/middleware/basicauth.md (7)

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-09-25T15:57:10.221Z
Learning: In the Fiber framework tests, using ctx.Response.Header.Cookie may not be suitable for parsing cookies from the response header, as it requires a *Cookie and fills it rather than returning a string value; thus, manual parsing of the Set-Cookie header may be necessary.

Learnt from: gaby
PR: #3193
File: middleware/cache/cache_test.go:897-897
Timestamp: 2024-11-08T04:10:42.990Z
Learning: In the Fiber framework, Context() is being renamed to RequestCtx(), and UserContext() to Context() to improve clarity and align with Go's context conventions.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the Fiber framework tests, using ctx.Response.Header.Cookie may not be suitable for parsing cookies from the response header, as it requires a *Cookie and fills it rather than returning a string value; thus, manual parsing of the Set-Cookie header may be necessary.

Learnt from: gaby
PR: #3193
File: middleware/adaptor/adaptor.go:111-111
Timestamp: 2024-11-10T23:44:13.704Z
Learning: In the middleware/adaptor/adaptor.go file of the Fiber framework, when updating context handling, replacing c.Context() with c.RequestCtx() is appropriate to access the fasthttp.RequestCtx.

Learnt from: ReneWerner87
PR: #3161
File: app.go:923-932
Timestamp: 2024-11-15T07:56:21.623Z
Learning: In the Fiber framework, breaking changes are acceptable when moving from version 2 to version 3, including modifications to method signatures such as in the Test method in app.go.

Learnt from: sixcolors
PR: #3016
File: middleware/session/config.go:122-122
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In DefaultErrorHandler(c *fiber.Ctx, err error), since c is a pointer to an interface, we need to dereference *c when calling interface methods like SendStatus.

Learnt from: sixcolors
PR: #3016
File: middleware/session/config.go:122-122
Timestamp: 2024-09-25T16:18:34.719Z
Learning: In DefaultErrorHandler(c *fiber.Ctx, err error), since c is a pointer to an interface, we need to dereference *c when calling interface methods like SendStatus.

docs/whats_new.md (13)

Learnt from: ReneWerner87
PR: #3161
File: app.go:923-932
Timestamp: 2024-11-15T07:56:21.623Z
Learning: In the Fiber framework, breaking changes are acceptable when moving from version 2 to version 3, including modifications to method signatures such as in the Test method in app.go.

Learnt from: sixcolors
PR: #3446
File: docs/middleware/logger.md:44-44
Timestamp: 2025-05-13T00:19:16.407Z
Learning: In documentation files for the Fiber framework, code examples are often partial and don't repeat import statements that were shown in earlier examples, focusing instead on demonstrating specific usage patterns.

Learnt from: gaby
PR: #3193
File: middleware/cache/cache_test.go:897-897
Timestamp: 2024-11-08T04:10:42.990Z
Learning: In the Fiber framework, Context() is being renamed to RequestCtx(), and UserContext() to Context() to improve clarity and align with Go's context conventions.

Learnt from: gaby
PR: #3193
File: middleware/adaptor/adaptor.go:111-111
Timestamp: 2024-11-10T23:44:13.704Z
Learning: In the middleware/adaptor/adaptor.go file of the Fiber framework, when updating context handling, replacing c.Context() with c.RequestCtx() is appropriate to access the fasthttp.RequestCtx.

Learnt from: sixcolors
PR: #3598
File: docs/middleware/csrf.md:37-42
Timestamp: 2025-07-19T14:06:29.884Z
Learning: In Fiber v3, the CookieSameSite constants use lowercase values: CookieSameSiteLaxMode = "lax", CookieSameSiteStrictMode = "strict", CookieSameSiteNoneMode = "none". Documentation examples should use lowercase string values or the typed constants, not capitalized strings like "Lax".

Learnt from: ckoch786
PR: #3230
File: docs/whats_new.md:944-951
Timestamp: 2024-12-15T19:56:45.935Z
Learning: Detailed usage examples and explanations for new methods like RemoveRoute and RemoveRouteByName are documented in docs/api/app.md, so it's unnecessary to duplicate them in docs/whats_new.md.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/session_manager.go:30-43
Timestamp: 2024-09-25T16:15:39.392Z
Learning: In the session middleware, session.FromContext(c) returns *session.Middleware, whereas m.session.Get(c) returns *session.Store, so they are not directly interchangeable.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/session_manager.go:30-43
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware, session.FromContext(c) returns *session.Middleware, whereas m.session.Get(c) returns *session.Store, so they are not directly interchangeable.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:164-165
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the Test_CSRF_WithSession_Middleware function, calling session.NewWithStore() without arguments is acceptable, as the default configuration is sufficient.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:164-165
Timestamp: 2024-09-25T17:08:07.693Z
Learning: In the Test_CSRF_WithSession_Middleware function, calling session.NewWithStore() without arguments is acceptable, as the default configuration is sufficient.

Learnt from: sixcolors
PR: #3625
File: middleware/session/config.go:57-58
Timestamp: 2025-07-27T17:28:53.403Z
Learning: In the session middleware Config struct, the Extractor field uses function closures (like FromCookie(key)), making it impossible to introspect extractor parameters at runtime for validation purposes without complex reflection techniques.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-09-25T15:57:10.221Z
Learning: In the Fiber framework tests, using ctx.Response.Header.Cookie may not be suitable for parsing cookies from the response header, as it requires a *Cookie and fills it rather than returning a string value; thus, manual parsing of the Set-Cookie header may be necessary.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the Fiber framework tests, using ctx.Response.Header.Cookie may not be suitable for parsing cookies from the response header, as it requires a *Cookie and fills it rather than returning a string value; thus, manual parsing of the Set-Cookie header may be necessary.

middleware/basicauth/basicauth_test.go (14)

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:164-165
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the Test_CSRF_WithSession_Middleware function, calling session.NewWithStore() without arguments is acceptable, as the default configuration is sufficient.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:164-165
Timestamp: 2024-09-25T17:08:07.693Z
Learning: In the Test_CSRF_WithSession_Middleware function, calling session.NewWithStore() without arguments is acceptable, as the default configuration is sufficient.

Learnt from: sixcolors
PR: #3051
File: middleware/session/session.go:215-216
Timestamp: 2024-06-30T00:38:06.580Z
Learning: Parallel tests for Session.Save already exist in the middleware/session/session_test.go file, specifically in the Test_Session_Save and Test_Session_Save_Expiration functions.

Learnt from: sixcolors
PR: #3051
File: middleware/session/session.go:215-216
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Parallel tests for Session.Save already exist in the middleware/session/session_test.go file, specifically in the Test_Session_Save and Test_Session_Save_Expiration functions.

Learnt from: sixcolors
PR: #3016
File: middleware/session/middleware_test.go:400-407
Timestamp: 2024-09-25T17:09:03.756Z
Learning: In the Test_Session_Next function in middleware/session/middleware_test.go, the variable doNext is properly synchronized with the muNext mutex for both read and write access.

Learnt from: gaby
PR: #3056
File: middleware/encryptcookie/utils.go:22-25
Timestamp: 2024-07-02T13:29:56.992Z
Learning: The encryptcookie_test.go file contains unit tests that validate key lengths for both EncryptCookie and DecryptCookie functions, ensuring that invalid key lengths raise appropriate errors.

Learnt from: gaby
PR: #3056
File: middleware/encryptcookie/utils.go:22-25
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The encryptcookie_test.go file contains unit tests that validate key lengths for both EncryptCookie and DecryptCookie functions, ensuring that invalid key lengths raise appropriate errors.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-09-25T15:57:10.221Z
Learning: In the Fiber framework tests, using ctx.Response.Header.Cookie may not be suitable for parsing cookies from the response header, as it requires a *Cookie and fills it rather than returning a string value; thus, manual parsing of the Set-Cookie header may be necessary.

Learnt from: sixcolors
PR: #3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the Fiber framework tests, using ctx.Response.Header.Cookie may not be suitable for parsing cookies from the response header, as it requires a *Cookie and fills it rather than returning a string value; thus, manual parsing of the Set-Cookie header may be necessary.

Learnt from: sixcolors
PR: #3016
File: middleware/session/store.go:164-167
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Unit tests in this project use testify require.

Learnt from: sixcolors
PR: #3016
File: middleware/session/store.go:164-167
Timestamp: 2024-10-02T23:03:31.727Z
Learning: Unit tests in this project use testify require.

Learnt from: efectn
PR: #3162
File: hooks_test.go:228-228
Timestamp: 2024-12-13T08:14:22.851Z
Learning: In Go test files, prefer using the require methods from the testify package for assertions instead of manual comparisons and calls to t.Fatal or t.Fatalf.

Learnt from: sixcolors
PR: #2922
File: middleware/cors/utils.go:63-71
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The project uses the testify/assert package for assertions in unit tests.

Learnt from: sixcolors
PR: #2922
File: middleware/cors/utils.go:63-71
Timestamp: 2024-07-26T21:00:12.902Z
Learning: The project uses the testify/assert package for assertions in unit tests.

middleware/basicauth/config.go (2)

Learnt from: sixcolors
PR: #3016
File: middleware/session/config.go:16-26
Timestamp: 2024-10-08T19:06:06.583Z
Learning: In the session middleware Config struct, Store is backed by fiber.Storage; they are different entities serving distinct purposes in session management.

Learnt from: sixcolors
PR: #3016
File: middleware/session/config.go:16-26
Timestamp: 2024-09-25T16:17:00.969Z
Learning: In the session middleware Config struct, Store is backed by fiber.Storage; they are different entities serving distinct purposes in session management.

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)

GitHub Check: Compare
GitHub Check: unit (1.24.x, macos-latest)
GitHub Check: unit (1.24.x, windows-latest)
GitHub Check: repeated
GitHub Check: Analyse

🔇 Additional comments (6)

middleware/basicauth/config.go (1)

70-77: LGTM! Clean formatting improvement.

The reformatting of the ConfigDefault variable improves code readability and maintains consistent styling. All configuration values remain unchanged.

middleware/basicauth/basicauth.go (1)

15-18: LGTM! Security improvement through password removal.

The updated comment and constants correctly reflect that only the username is now stored in the request context. Removing password storage from the context is a good security practice - the middleware now only exposes the username after successful authentication.

docs/middleware/basicauth.md (1)

9-9: LGTM! Important security documentation added.

Adding information about the Vary: Authorization header is crucial for users to understand the caching behavior. This header prevents proxy servers and browsers from caching responses based on different authorization credentials, which is an important security feature.

middleware/basicauth/basicauth_test.go (2)

61-61: LGTM! Test correctly reflects new behavior.

The test handler now properly retrieves only the username from context, which aligns with the removal of password storage functionality.

105-105: LGTM! Test assertion correctly updated.

The test assertion now expects only the username in the response body, which is consistent with the removal of password storage and correctly validates the new middleware behavior.

docs/whats_new.md (1)

1056-1057: LGTM! Comprehensive documentation of BasicAuth improvements.

This section accurately documents all the key security and functionality improvements made to the BasicAuth middleware in v3:

Enhanced header validation and security headers (Vary: Authorization)

Requirement for hashed passwords (improved security)

Removal of password storage in context (better security practices)

New configuration options (HeaderLimit, Charset)

Updated Authorizer function signature

The documentation clearly communicates these breaking changes and security improvements to users.

✨ Finishing Touches

📝 Generate Docstrings

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch 2025-07-31-02-07-31

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

Copilot

Pull Request Overview

This PR improves the BasicAuth middleware documentation and removes the StorePassword feature. The purpose is to simplify the API by dropping password storage functionality while improving documentation clarity.

Key changes:

Removes StorePassword configuration option and PasswordFromContext function
Documents the Vary: Authorization header behavior in responses
Updates documentation to reflect the removal of password storage functionality

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
middleware/basicauth/config.go	Removes `StorePassword` field from Config struct and default configuration
middleware/basicauth/basicauth_test.go	Removes tests related to password storage and updates existing tests
middleware/basicauth/basicauth.go	Removes `PasswordFromContext` function and password storage logic
docs/whats_new.md	Updates documentation to reflect removal of `StorePassword` and documents `Vary: Authorization` header
docs/middleware/basicauth.md	Removes password retrieval examples and `StorePassword` configuration documentation

Comments suppressed due to low confidence (1)

middleware/basicauth/basicauth_test.go:106

Missing closing brace for the for loop. The code block appears to be incomplete.

gemini-code-assist

Summary of Changes

Hello @gaby, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request primarily focuses on enhancing the security of the BasicAuth middleware by removing the ability to store plaintext passwords in the request context. It also updates the associated documentation to reflect this significant change and to clarify the caching behavior of unauthorized responses.

Highlights

Security Enhancement: The StorePassword configuration option and the PasswordFromContext function have been completely removed from the BasicAuth middleware. This change enhances security by preventing plaintext passwords from being stored in the request context, ensuring that passwords are only used for authentication and not retained.
Documentation Updates: The documentation for the BasicAuth middleware (docs/middleware/basicauth.md) and the 'What's New' section (docs/whats_new.md) have been updated to reflect the removal of the StorePassword option and the PasswordFromContext function. Additionally, the documentation now explicitly mentions that unauthorized responses include a Vary: Authorization header for improved caching behavior.
API Changes: The PasswordFromContext function is no longer available for retrieving passwords from the context, and the StorePassword field has been removed from the Config struct of the BasicAuth middleware.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments or fill out our survey to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request effectively removes the StorePassword functionality from the BasicAuth middleware, which is a good simplification and security improvement. The changes are consistently applied across the implementation, tests, and documentation. The documentation is also updated to reflect the addition of the Vary: Authorization header. I've added a couple of minor suggestions to improve documentation clarity and code conciseness. Overall, great work!

docs/middleware/basicauth.md

middleware/basicauth/basicauth.go

codecov · 2025-07-31T02:09:08Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.81%. Comparing base (c309d46) to head (7e1069f).
⚠️ Report is 12 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3638      +/-   ##
==========================================
- Coverage   91.82%   91.81%   -0.01%     
==========================================
  Files         113      113              
  Lines       11426    11418       -8     
==========================================
- Hits        10492    10484       -8     
  Misses        671      671              
  Partials      263      263

Flag	Coverage Δ
unittests	`91.81% <ø> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.50.

Benchmark suite	Current: `7e1069f`	Previous: `c309d46`	Ratio
`Benchmark_Ctx_Links - B/op`	`1` B/op	`0` B/op	`+∞`

This comment was automatically generated by workflow using github-action-benchmark.

ReneWerner87 · 2025-08-01T13:17:12Z

gofiber/cli#152

Remove StorePassword option

7e1069f

Copilot AI review requested due to automatic review settings July 31, 2025 02:07

gaby requested a review from a team as a code owner July 31, 2025 02:07

gaby added the codex label Jul 31, 2025 — with ChatGPT Codex Connector

gaby requested review from ReneWerner87, efectn and sixcolors July 31, 2025 02:07

github-actions bot added the 📒 Documentation label Jul 31, 2025

Copilot AI reviewed Jul 31, 2025

View reviewed changes

gemini-code-assist bot reviewed Jul 31, 2025

View reviewed changes

docs/middleware/basicauth.md Show resolved Hide resolved

middleware/basicauth/basicauth.go Show resolved Hide resolved

gaby changed the title ~~Improve BasicAuth docs~~ 🧹 chore: Remove support for PasswordFromContext from BasicAuth middleware Jul 31, 2025

gaby added 🧹 Updates v3 and removed 📒 Documentation labels Jul 31, 2025

gaby added this to v3 Jul 31, 2025

gaby added this to the v3 milestone Jul 31, 2025

gaby moved this to In Progress in v3 Jul 31, 2025

github-actions bot reviewed Jul 31, 2025

View reviewed changes

ReneWerner87 approved these changes Aug 1, 2025

View reviewed changes

ReneWerner87 merged commit ceacde5 into main Aug 1, 2025
15 of 16 checks passed

ReneWerner87 deleted the 2025-07-31-02-07-31 branch August 1, 2025 10:48

github-project-automation bot moved this from In Progress to Done in v3 Aug 1, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🧹 chore: Remove support for PasswordFromContext from BasicAuth middleware#3638

🧹 chore: Remove support for PasswordFromContext from BasicAuth middleware#3638
ReneWerner87 merged 1 commit intomainfrom
2025-07-31-02-07-31

gaby commented Jul 31, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Jul 31, 2025 •

edited

Loading

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

Uh oh!

Copilot AI left a comment

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Jul 31, 2025 •

edited

Loading

Uh oh!

github-actions bot left a comment

Uh oh!

Uh oh!

ReneWerner87 commented Aug 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

gaby commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

coderabbitai bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

⚠️ Performance Alert ⚠️

Uh oh!

Uh oh!

ReneWerner87 commented Aug 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gaby commented Jul 31, 2025 •

edited

Loading

coderabbitai bot commented Jul 31, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)

codecov bot commented Jul 31, 2025 •

edited

Loading