might as well be auth(ctx) about basic-auth

[tj]

going to redo with https://github.com/visionmedia/node-basic-auth
and make this a blanket middleware

[jonathanong]

so the last repo in the koajs org that touches the protos is the CSRF one. i'm not sure how to do it better - middleware just to create a getter is silly IMO, and doing it as csrf(this) is the same as a middleware, but more annoying.

csrf(this).get() and csrf(this).check(body) would be annoying, though it makes sense. i'd also like to be able to choose the "secret", i.e. cookie sessions could just use .sid whereas db stores should use .secret or something.

but then again, we can make it generic like basic-auth, but then so many options!!! i think it should just be included in session middleware.

[tj]

im always a fan of generic stuff and then going progressively more special-cased as long as there's enough work to make it really worth the effort

[jonathanong]

i don't disagree, but for csrf, being generic is more difficult than just inlining it in your app since you have a lot of options/environments to take into account.

[tj]

yeah that's how it was using visionmedia/send with generators, not worth the pain, the rewrite was easier than trying to get janky event stuff to work properly

[jonathanong]

you can only set a single username and password? kind of useless haha. should just be an example instead of a middleware.

[tj]

that's the average use-case, when you want to chuck something up on a port that's all you ever really need, once you go beyond that there's no point using middleware for it. we use it all the time though, private stats, monitoring stuff, job queue UIs etc