{"id":"e8a87174f784d1d4","repo":"labstack/echo","slug":"echo-basic-auth-middleware-requires-a-validator-fu","errorCode":null,"errorMessage":"echo basic-auth middleware requires a validator function","messagePattern":"echo basic-auth middleware requires a validator function","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"middleware/basic_auth.go","lineNumber":99,"sourceCode":")\n\n// BasicAuth returns an BasicAuth middleware.\n//\n// For valid credentials it calls the next handler.\n// For missing or invalid credentials, it sends \"401 - Unauthorized\" response.\nfunc BasicAuth(fn BasicAuthValidator) echo.MiddlewareFunc {\n\treturn BasicAuthWithConfig(BasicAuthConfig{Validator: fn})\n}\n\n// BasicAuthWithConfig returns an BasicAuthWithConfig middleware with config.\nfunc BasicAuthWithConfig(config BasicAuthConfig) echo.MiddlewareFunc {\n\treturn toMiddlewareOrPanic(config)\n}\n\n// ToMiddleware converts BasicAuthConfig to middleware or returns an error for invalid configuration\nfunc (config BasicAuthConfig) ToMiddleware() (echo.MiddlewareFunc, error) {\n\tif config.Validator == nil {\n\t\treturn nil, errors.New(\"echo basic-auth middleware requires a validator function\")\n\t}\n\tif config.Skipper == nil {\n\t\tconfig.Skipper = DefaultSkipper\n\t}\n\trealm := defaultRealm\n\tif config.Realm != \"\" {\n\t\trealm = config.Realm\n\t}\n\trealm = strconv.Quote(realm)\n\tlimit := cmp.Or(config.AllowedCheckLimit, 1)\n\n\treturn func(next echo.HandlerFunc) echo.HandlerFunc {\n\t\treturn func(c *echo.Context) error {\n\t\t\tif config.Skipper(c) {\n\t\t\t\treturn next(c)\n\t\t\t}\n\n\t\t\tvar lastError error","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/labstack/echo/blob/05489dc1730161df26b72d1ae2a3ba6fb8178fc7/middleware/basic_auth.go#L81-L117","documentation":"Returned by BasicAuthConfig.ToMiddleware when config.Validator is nil, then converted to a panic by toMiddlewareOrPanic since BasicAuthWithConfig cannot return an error. BasicAuth requires a Validator function to check credentials; without one the middleware cannot authenticate. This is a startup/configuration error, not a runtime request error.","triggerScenarios":"Calling middleware.BasicAuthWithConfig(middleware.BasicAuthConfig{}) without setting Validator, or calling middleware.BasicAuth(nil). The panic occurs at server setup time when the middleware chain is built.","commonSituations":"Copy-pasting a BasicAuth example but deleting the Validator assignment. Refactoring that accidentally removes the Validator. Conditional config where a branch leaves Validator nil.","solutions":["Provide a Validator function: middleware.BasicAuth(func(c echo.Context, user, pass string) (bool, error) { ... })","If using BasicAuthWithConfig, set config.Validator to a BasicAuthValidator function","Use config.ToMiddleware() (which returns an error) instead of BasicAuthWithConfig if you want to handle the error without panicking"],"exampleFix":"// before\nmw := middleware.BasicAuthWithConfig(middleware.BasicAuthConfig{}) // panic\n\n// after\nmw := middleware.BasicAuth(func(c echo.Context, u, p string) (bool, error) {\n    return u == \"admin\" && p == \"secret\", nil\n})","handlingStrategy":"validation","validationCode":"// Use ToMiddleware (returns error) instead of WithConfig (panics)\nif _, err := (middleware.BasicAuthConfig{}).ToMiddleware(); err != nil {\n    log.Fatal(\"BasicAuth requires Validator:\", err)\n}","typeGuard":null,"tryCatchPattern":"// Since BasicAuthWithConfig panics, use a recover or ToMiddleware\ndefer func() {\n    if r := recover(); r != nil {\n        log.Fatal(\"middleware setup failed:\", r)\n    }\n}()\nmw := middleware.BasicAuthWithConfig(cfg)","preventionTips":["Always pass a Validator function to BasicAuth / BasicAuthConfig","Use config.ToMiddleware() in setup to catch config errors without panicking","Add startup smoke tests that build the middleware chain"],"tags":["middleware","basic-auth","configuration","panic","startup"],"analyzedSha":"05489dc1730161df26b72d1ae2a3ba6fb8178fc7","analyzedAt":"2026-08-04T21:32:47.783Z","schemaVersion":2}