buddy-auth

Authentication and authorization for Ring web applications.

Stack

What

buddy-auth provides pluggable authentication and authorization for Ring and Ring-based web applications:

• Authentication backends: API key, HTTP Basic, session, and token. Token covers signed JWT and JWE through buddy-sign, and JWKS/OIDC token validation through jose-clj.
• Ring middleware: wrap-authentication / wrap-authorization.
• Access rules: declarative authorization for each route with clout patterns.

Installation

deps.edn:

net.clojars.savya/buddy-auth {:mvn/version "4.1.0"}

Leiningen:

[net.clojars.savya/buddy-auth "4.1.0"]

Usage

(require '[buddy.auth :refer [authenticated?]]
         '[buddy.auth.backends :as backends]
         '[buddy.auth.middleware :refer [wrap-authentication]])

(def backend (backends/basic {:authfn my-authfn}))

(def app
  (-> handler
      (wrap-authentication backend)))

Access rules

wrap-access-rules accepts reusable named policies and preserves the historical allow-on-unmatched default. Set :default-deny true to reject requests that do not match any route rule. Policy references may be keywords or strings; unknown names fail during compilation.

(wrap-access-rules handler
  {:policies {:member {:and [authenticated? has-member-role?]}}
   :rules [{:match {:and [{:uri "/account/:id"}
                          {:host "app.example.com"}
                          {:header {"x-tenant" "acme"}}
                          {:query-param {"view" #{"summary" "full"}}}]}
            :handler :member}]
   :default-deny true})

Request matchers support :uri, :uris, and :pattern together with :host, :header, and :query-param. Matcher expressions use :and, :or, and :not; scalar values compare exactly, regular expressions match strings, and collections match when any value matches.

Full guide: cljdoc and doc/user-guide.md.

Modern integration examples for Ring 1.12+, Reitit route data, JSON API error responses, and Clojure CLI are in the user guide.

Maintenance fork

This is a maintenance fork of funcool/buddy-auth. The README of that project said it was in maintenance mode and needed a new maintainer. This fork uses current buddy-sign and tools.build. It runs CI on Clojure 1.11 and 1.12. It is published as net.clojars.savya/buddy-auth. Andrey Antukh and contributors did the original work.

License

Copyright © 2013-2022 Andrey Antukh.

Maintenance fork (2026) by Savyasachi, original: https://github.com/funcool/buddy-auth. Distributed under the Apache License 2.0, preserving the original license.