Username / Password

The traditional method: email + password login with optional email verification on registration, password strength rules, and a built-in restore/reset recovery flow.

How It Works

sequenceDiagram
  actor U as User
  participant P as Login page
  participant A as Auth API
  participant B as PostAuth pipeline
  U->>P: enter email + password
  P->>A: POST /api/login
  A->>B: FuncUserLogin(email, password)
  alt credentials valid
    B-->>U: session token + cookie
  else invalid
    B-->>P: generic error (anti-enumeration)
  end
  Note over U,A: Registration: names + email + password
  Note over U,A: with EnableVerification → code email → create on verify

User submits email + password on /auth/login
FuncUserLogin(username, password) validates credentials → post-auth → token + cookie
Registration collects email + password + names; with EnableVerification a code is emailed and the account is created on verify — otherwise immediately

Recovery

/auth/password-restore emails a reset link → /auth/password-reset sets the new password via FuncUserPasswordChange and invalidates existing sessions.

Setup

a, err := auth.NewUsernameAndPasswordAuth(types.ConfigUsernameAndPassword{
    ConfigShared: types.ConfigShared{
        Endpoint:                "/auth",
        UrlRedirectOnSuccess:    "/",
        UseCookies:              true,
        FuncTemporaryKeyGet:     tempKeyGet,
        FuncTemporaryKeySet:     tempKeySet,
        FuncUserFindByAuthToken: userFindByAuthToken,
        FuncUserLogout:          userLogout,
        FuncUserStoreAuthToken:  userStoreAuthToken,
        EnableRegistration:      true,
    },
    FuncUserLogin:          userLogin,
    FuncUserRegister:       userRegister,
    FuncUserFindByUsername: userFindByUsername,
    FuncUserPasswordChange: userPasswordChange,
    FuncEmailSend:          emailSend,
})
mux.Handle("/auth/", http.StripPrefix("", a.Router()))

Routes

Route	Behavior
`GET\|POST /auth/login`	Email+password form + login API
`GET /auth/register`	Registration form (names + email + password)
`GET /auth/register-code-verify`	Verification code entry (when verification enabled)
`GET /auth/password-restore`	Request reset link
`GET /auth/password-reset`	Set new password
`GET /auth/logout`	Logout page

Notes

Password strength is configurable via PasswordStrength (min length, character classes)
Password auth is orthogonal to the verified-email pipeline — a host choice, not a pipeline branch
Anti-enumeration: when FuncUserExists is configured, login errors are uniform for missing vs. wrong-password accounts

A complete working example is available in examples/usernamepassword.