What causes "BasicAuth: Allow field is required" in kataras/iris?

Set Allow in the config, e.g. Allow: basicauth.DefaultUserMap or a custom func(user, pass string) bool.

BasicAuth: Allow field is required

Error message

BasicAuth: Allow field is required

What it means

basicauth.New panics when the Config's Allow field is nil (middleware/basicauth/basicauth.go:200). Allow is the required func(username, password string) bool that decides which credentials are accepted; without it the middleware cannot authorize anyone.

Source

Thrown at middleware/basicauth/basicauth.go:200

//		},
//		Allow: basicauth.AllowUsers(users),
//	}
//	auth := basicauth.New(opts)
//	app.Use(auth)
//
// Access the user in the route handler with: ctx.User().GetRaw().(*myCustomType).
//
// Look the BasicAuth type docs for more information.
func New(opts Options) context.Handler {
	var (
		askCode                 = http.StatusUnauthorized
		authorizationHeader     = authorizationHeaderKey
		authenticateHeader      = authenticateHeaderKey
		authenticateHeaderValue = "Basic"
	)

	if opts.Allow == nil {
		panic("BasicAuth: Allow field is required")
	}

	if opts.Realm != "" {
		authenticateHeaderValue += " realm=" + strconv.Quote(opts.Realm)
	}

	if opts.Proxy {
		askCode = http.StatusProxyAuthRequired
		authenticateHeader = proxyAuthenticateHeaderKey
		authorizationHeader = proxyAuthorizationHeaderKey
	}

	if opts.MaxTries > 0 && opts.MaxTriesCookie == "" {
		opts.MaxTriesCookie = DefaultMaxTriesCookie
	}

	if opts.ErrorHandler == nil {
		opts.ErrorHandler = DefaultErrorHandler

View on GitHub (pinned to 7bedaf55a0)

Solutions

Set Allow in the config, e.g. Allow: basicauth.DefaultUserMap or a custom func(user, pass string) bool.
Use basicauth.Default(basicauth.User{"admin": "password"}) which populates Allow for you.
If loading from a file, use basicauth.Load and ensure the config includes an allow rule.

Example fix

// before
db := basicauth.New(basicauth.Config{Realm: "Restricted"}) // panics

// after
db := basicauth.New(basicauth.Config{
    Realm: "Restricted",
    Allow: func(user, pass string) bool {
        return user == "admin" && pass == "secret"
    },
})

Defensive patterns

Strategy: validation

Validate before calling

// Guard before basicauth.New
if cfg.Allow == nil {
    return errors.New("basicauth: Allow must be set")
}
db := basicauth.New(cfg)

Type guard

func allowConfigured(c basicauth.Config) bool {
    return c.Allow != nil
}

Try / catch

defer func() {
    if r := recover(); r != nil {
        log.Fatalf("basicauth config invalid: %v", r)
    }
}()

Prevention

Use basicauth.Default(users) which fills Allow automatically.
When writing a Config literal, always include the Allow field first.
Validate middleware configs in a startup test so panics surface before deployment.

When it happens

Trigger: Calling basicauth.New(basicauth.Config{...}) without setting Allow — often when constructing the Config struct literal manually instead of using basicauth.Default(users).

Common situations: Copying a Config snippet that only sets Realm and Expires; forgetting Allow after refactoring from Default/Load to New with an explicit Config.

Related errors

AI-assisted analysis of kataras/iris@7bedaf55a0 (2026-08-30). Data as JSON: /api/errors/0bae183aa729544e. Report an issue: GitHub.