{"action":"created","issue":{"url":"https://api.github.com/repos/akka/akka/issues/19321","labels_url":"https://api.github.com/repos/akka/akka/issues/19321/labels{/name}","comments_url":"https://api.github.com/repos/akka/akka/issues/19321/comments","events_url":"https://api.github.com/repos/akka/akka/issues/19321/events","html_url":"https://github.com/akka/akka/issues/19321","id":124477467,"number":19321,"title":"Akka HTTP: Cannot access the received secret when using basic auth","user":{"login":"cb372","id":106760,"avatar_url":"https://avatars.githubusercontent.com/u/106760?v=3","gravatar_id":"","url":"https://api.github.com/users/cb372","html_url":"https://github.com/cb372","followers_url":"https://api.github.com/users/cb372/followers","following_url":"https://api.github.com/users/cb372/following{/other_user}","gists_url":"https://api.github.com/users/cb372/gists{/gist_id}","starred_url":"https://api.github.com/users/cb372/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cb372/subscriptions","organizations_url":"https://api.github.com/users/cb372/orgs","repos_url":"https://api.github.com/users/cb372/repos","events_url":"https://api.github.com/users/cb372/events{/privacy}","received_events_url":"https://api.github.com/users/cb372/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-31T14:53:34Z","updated_at":"2016-01-04T08:58:38Z","closed_at":null,"body":"I'm trying to port a Spray app to Akka HTTP 2.0.1, and I'm having trouble porting some code that uses Spray's `authenticate` directive.\r\n\r\nThe problem is that the process for verifying the received password is hardcoded to a string equality check:\r\n\r\n```\r\n// akka.http.scaladsl.server.directives.Credentials\r\ndef apply(cred: Option[HttpCredentials]): Credentials = {\r\n  cred match {\r\n    case Some(BasicHttpCredentials(username, receivedSecret)) ⇒\r\n      new Credentials.Provided(username) {         \r\n        def verify(secret: String): Boolean = secret secure_== receivedSecret\r\n      }\r\n    // ...\r\n  }\r\n}\r\n```\r\n\r\nI want to be able to customise this verification logic. For example, in this particular app we take the received password, hash it using scrypt, then compare it with a hash retrieved from the DB.\r\n\r\nI can work around it for now by not using the `Credentials.apply` method, but that means I need to copy-paste and tweak the whole `authenticateBasicAsync` directive. It would be nice if there was a way to pass in my own verification predicate, with a type something like `(user, receivedSecret) => Boolean`."},"comment":{"url":"https://api.github.com/repos/akka/akka/issues/comments/168615249","html_url":"https://github.com/akka/akka/issues/19321#issuecomment-168615249","issue_url":"https://api.github.com/repos/akka/akka/issues/19321","id":168615249,"user":{"login":"jrudolph","id":9868,"avatar_url":"https://avatars.githubusercontent.com/u/9868?v=3","gravatar_id":"","url":"https://api.github.com/users/jrudolph","html_url":"https://github.com/jrudolph","followers_url":"https://api.github.com/users/jrudolph/followers","following_url":"https://api.github.com/users/jrudolph/following{/other_user}","gists_url":"https://api.github.com/users/jrudolph/gists{/gist_id}","starred_url":"https://api.github.com/users/jrudolph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jrudolph/subscriptions","organizations_url":"https://api.github.com/users/jrudolph/orgs","repos_url":"https://api.github.com/users/jrudolph/repos","events_url":"https://api.github.com/users/jrudolph/events{/privacy}","received_events_url":"https://api.github.com/users/jrudolph/received_events","type":"User","site_admin":false},"created_at":"2016-01-04T08:58:38Z","updated_at":"2016-01-04T08:58:38Z","body":"I agree. We had a previous suggestion how to solve the issue here: #18858. Would that also work for you?"}}