Repository: ktorio/ktor
File: ktor-server/ktor-server-plugins/ktor-server-auth-api-key/common/src/io/ktor/server/auth/apikey/ApiKeyAuth.kt (Kotlin)

Code before:
            context.principal(principal)
        }
    }

    /**
     * Configuration for API Key authentication.
     *
     * @param name optional name for this authentication provider.
     */
    public class Configuration internal constructor(name: String?) : Config(name) {

        internal var authenticationFunction: ApiKeyAuthenticationFunction? = null

        internal var challengeFunction: ApiKeyAuthChallengeFunction = { call ->
            call.respond(HttpStatusCode.Unauthorized)
        }

        /**
         * Name of the scheme used when challenge fails, see [AuthenticationContext.challenge].
         */
        public var authScheme: String = "apiKey"

        /**
         * Name of the header that will be used as a source for the api key.
         */
        public var headerName: String = "X-Api-Key"

        /**
         * Sets a validation function that will check the given API key retrieved from the [headerName] header
         * and return an arbitrary principal object (for example, a user or service identity) if authentication
         * succeeds, or null if authentication fails.
         *
         * @param body the validation function that receives the API key as a [String] parameter and returns
         * an arbitrary principal object or null.
         */
        public fun validate(body: ApiKeyAuthenticationFunction) {
            authenticationFunction = body
        }

        /**
         * A response to send back if authentication failed.
         *
         * @param body the challenge function that handles authentication failures.
         */
        public fun challenge(body: ApiKeyAuthChallengeFunction) {
            challengeFunction = body
        }
    }
}


Review comment (security):
Perhaps we could expose the default values as public constants under a `ApiKeyAuth` object for a little extra tooling when using defaults - then we can remove the declaration in the tests.

Code after:
            context.principal(principal)
        }
    }

    /**
     * Configuration for API Key authentication.
     *
     * @param name optional name for this authentication provider.
     */
    public class Configuration internal constructor(name: String?) : Config(name) {

        internal var authenticationFunction: ApiKeyAuthenticationFunction? = null

        internal var challengeFunction: ApiKeyAuthChallengeFunction = { call ->
            call.respond(HttpStatusCode.Unauthorized)
        }

        /**
         * Name of the scheme used when challenge fails, see [AuthenticationContext.challenge].
         */
        public var authScheme: String = "apiKey"

        /**
         * Name of the header that will be used as a source for the api key.
         */
        public var headerName: String = ApiKeyAuth.DEFAULT_HEADER_NAME

        /**
         * Sets a validation function that will check the given API key retrieved from the [headerName] header
         * and return an arbitrary principal object (for example, a user or service identity) if authentication
         * succeeds, or null if authentication fails.
         *
         * @param body the validation function that receives the API key as a [String] parameter and returns
         * an arbitrary principal object or null.
         */
        public fun validate(body: ApiKeyAuthenticationFunction) {
            authenticationFunction = body
        }

        /**
         * A response to send back if authentication failed.
         *
         * @param body the challenge function that handles authentication failures.
         */
        public fun challenge(body: ApiKeyAuthChallengeFunction) {
            challengeFunction = body
        }
    }
}

/**