Auth

auth

Defines an HTTP Basic Auth gate for the Modal-hosted app

Why Basic Auth

• A browser can't attach Modal's proxy tokens to the initial page navigation, which is the usual way to protect modal-deployed web apps

• Since the mirumoji-hosted FastAPI app serves a browser SPA, it is protected with HTTP Basic Auth instead

• The browser prompts once and then sends the credentials on every request, so the whole app is gated without requiring implementation of auth tooling in the server and frontend

• This is done so that the main app can remain free of authentication, since its primary usage is as a self-hosted app

BasicAuthMiddleware

Pure-ASGI middleware that gates every request behind HTTP Basic Auth

Browser-Native

• A 401 with a WWW-Authenticate: Basic header makes the browser show its own credential prompt and then send Authorization: Basic on every later request, including the top-level navigation

• This needs no login page or session, so the server and the frontend are unchanged

Constant-Time

The credentials and the cookie are compared with hmac.compare_digest, so the check does not leak the secret through timing

Public Install Assets

A short allowlist of PWA install files (the manifest, icons, and screenshots) is served without auth, since the browser fetches them without credentials and gating them breaks the install (see _is_public_asset)

Persistent Cookie

• After a passed check, the middleware sets a signed cookie derived from the password and accepts that cookie in place of the credentials

• An installed iOS PWA drops the browser's Basic Auth cache when it is suspended or closed, so without the cookie it re-prompts on every reopen. The cookie persists that state, and rotating the password invalidates every previously issued cookie

__call__(scope, receive, send) async

Gates HTTP requests, letting a valid persistent cookie or Basic Auth through and passing other scopes and the public PWA install assets straight through

Parameters:

Name	Type	Description	Default
scope	Scope	The ASGI connection scope	required
receive	Receive	The ASGI receive channel	required
send	Send	The ASGI send channel	required

__init__(app, *, username, password, realm='Mirumoji')

Sets up the HTTP Basic Auth token and challenge headers based on the provided arguments

Parameters:

Name	Type	Description	Default
app	ASGIApp	The application to wrap	required
username	str	The expected username	required
password	str	The expected password	required
realm	str	The realm shown in the browser's prompt	'Mirumoji'