{"record":{"id":"0bae183aa729544e","repo":"kataras/iris","slug":"basicauth-allow-field-is-required","errorCode":null,"errorMessage":"BasicAuth: Allow field is required","messagePattern":"BasicAuth: Allow field is required","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/basicauth/basicauth.go","lineNumber":200,"sourceCode":"//\t\t},\n//\t\tAllow: basicauth.AllowUsers(users),\n//\t}\n//\tauth := basicauth.New(opts)\n//\tapp.Use(auth)\n//\n// Access the user in the route handler with: ctx.User().GetRaw().(*myCustomType).\n//\n// Look the BasicAuth type docs for more information.\nfunc New(opts Options) context.Handler {\n\tvar (\n\t\taskCode                 = http.StatusUnauthorized\n\t\tauthorizationHeader     = authorizationHeaderKey\n\t\tauthenticateHeader      = authenticateHeaderKey\n\t\tauthenticateHeaderValue = \"Basic\"\n\t)\n\n\tif opts.Allow == nil {\n\t\tpanic(\"BasicAuth: Allow field is required\")\n\t}\n\n\tif opts.Realm != \"\" {\n\t\tauthenticateHeaderValue += \" realm=\" + strconv.Quote(opts.Realm)\n\t}\n\n\tif opts.Proxy {\n\t\taskCode = http.StatusProxyAuthRequired\n\t\tauthenticateHeader = proxyAuthenticateHeaderKey\n\t\tauthorizationHeader = proxyAuthorizationHeaderKey\n\t}\n\n\tif opts.MaxTries > 0 && opts.MaxTriesCookie == \"\" {\n\t\topts.MaxTriesCookie = DefaultMaxTriesCookie\n\t}\n\n\tif opts.ErrorHandler == nil {\n\t\topts.ErrorHandler = DefaultErrorHandler","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/middleware/basicauth/basicauth.go#L182-L218","documentation":"basicauth.New panics when the Config's Allow field is nil (middleware/basicauth/basicauth.go:200). Allow is the required func(username, password string) bool that decides which credentials are accepted; without it the middleware cannot authorize anyone.","triggerScenarios":"Calling basicauth.New(basicauth.Config{...}) without setting Allow — often when constructing the Config struct literal manually instead of using basicauth.Default(users).","commonSituations":"Copying a Config snippet that only sets Realm and Expires; forgetting Allow after refactoring from Default/Load to New with an explicit Config.","solutions":["Set Allow in the config, e.g. Allow: basicauth.DefaultUserMap or a custom func(user, pass string) bool.","Use basicauth.Default(basicauth.User{\"admin\": \"password\"}) which populates Allow for you.","If loading from a file, use basicauth.Load and ensure the config includes an allow rule."],"exampleFix":"// before\ndb := basicauth.New(basicauth.Config{Realm: \"Restricted\"}) // panics\n\n// after\ndb := basicauth.New(basicauth.Config{\n    Realm: \"Restricted\",\n    Allow: func(user, pass string) bool {\n        return user == \"admin\" && pass == \"secret\"\n    },\n})","handlingStrategy":"validation","validationCode":"// Guard before basicauth.New\nif cfg.Allow == nil {\n    return errors.New(\"basicauth: Allow must be set\")\n}\ndb := basicauth.New(cfg)","typeGuard":"func allowConfigured(c basicauth.Config) bool {\n    return c.Allow != nil\n}","tryCatchPattern":"defer func() {\n    if r := recover(); r != nil {\n        log.Fatalf(\"basicauth config invalid: %v\", r)\n    }\n}()","preventionTips":["Use basicauth.Default(users) which fills Allow automatically.","When writing a Config literal, always include the Allow field first.","Validate middleware configs in a startup test so panics surface before deployment."],"tags":["go","panic","authentication","basicauth"],"backgroundTag":"missing-required-config-field","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}