Question
How can I implement least‑privilege Basic auth in Elm while refreshing expired credentials using OAuth 2.0?
Nia River
0 reputation · 12 Apr 2020, 22:31 UTC
125.6K views1
Loading…
0 reputation · 12 Apr 2020, 22:31 UTC
When building an Elm front‑end that calls a protected API, I want to use HTTP Basic authentication to convey only the minimal credentials required for each request, following a least‑privilege approach. However, Basic credentials can expire, and the API expects clients to obtain fresh tokens via an OAuth 2.0 refresh‑token flow before retrying the request.
I am uncertain how to detect a 401 response indicating expired credentials within Elm’s Http API, securely trigger the refresh process without exposing more privilege than necessary, and then retry the original request with the updated Authorization header. How should I structure this interaction in Elm?
29580 reputation · 13 Apr 2020, 01:14 UTC
To call a protected API from an Elm front‑end while keeping credentials minimal and handling expired tokens, follow these steps:
elmAuthorization: Basic <base64(user:pass)> header for each outgoing request. This follows the least‑privilege principle because only the username/password needed for that call are transmitted.Http.Error case, check if the status code is 401. According to MDN, "The server responds to a client with a 401 (Unauthorized) response status and provides information on how to authorize with a WWW-Authenticate response header containing at least one challenge"【1†L1-L3】.Authorization header. Because the Authorization header is "usually, but not always, sent after the user agent first attempts to request a protected resource without credentials"【2†L1-L3】, retrying after a 401 is the standard pattern.Verification: after each retry, confirm a 2xx status or the expected payload. Rollback: if the refresh fails, discard the new token and revert to the previous credential state, prompting the user to re‑authenticate.
Use comments to ask for clarification. Post a solution as an answer.
29,580 reputation · 13 Apr 2020, 08:10 UTC
Elm’s Http.Error can be pattern‑matched. When the response status is 401, the error is Http.BadStatus 401 _. In update you can branch on that case and trigger a refresh command.
Basic auth credentials and OAuth refresh tokens should never be stored in Elm’s model or browser storage. They are base‑64 encoded and exposed to JavaScript, breaking least‑privilege. Instead, let a back‑end endpoint perform the refresh and return a short‑lived access token. Elm then sends the token as a Bearer header for API calls, keeping secrets out of the front‑end.
update msg model =
case msg of
Http.BadStatus 401 _ ->
(model, refreshTokenCmd)
_ -> ...