Add comprehensive Basic Authentication example

[jeremyandrews]

Add comprehensive Basic Authentication example

Summary

Adds examples/basic_auth.rs demonstrating three approaches to HTTP Basic Authentication in Goose load tests, addressing the static asset authentication problem described in issue #608.

Changes

New Files

• examples/basic_auth.rs - Complete working example with three authentication approaches
• src/docs/goose-book/src/example/basic-auth.md - Comprehensive documentation
• Updated src/docs/goose-book/src/SUMMARY.md and src/docs/goose-book/src/example/overview.md

Approaches Demonstrated

1. Custom Client with Default Headers (Recommended)

   • Sets up authentication once per user via set_client_builder()
   • Automatically applies to all requests including static assets
   • Solves the core problem from issue How can I test a site behind Basic Auth #608

2. Helper Function Approach

   • Adds Basic Auth to each request via helper function
   • More flexible but requires calling for every request
   • Does not handle static assets automatically

3. Manual Per-Request Authentication

   • Demonstrates the original problem where auth doesn't propagate
   • Shows why this approach fails for static assets

Configuration Support

• BASIC_AUTH_USERNAME / BASIC_AUTH_PASSWORD (separate variables)
• BASIC_AUTH="username:password" (combined format)
• Default credentials for httpbin.org testing

Testing

• Successfully tested with httpbin.org
• All three approaches work correctly
• Proper HTTP 200 responses for authenticated endpoints

Closes #608

[github-actions]

📋 Review Summary

This pull request introduces a comprehensive example for handling Basic Authentication in Goose load tests. The changes are well-structured, with clear code and thorough documentation. The addition of three different approaches to Basic Auth is particularly valuable for users.

🔍 General Feedback

• The new basic_auth.rs example is excellent. It's well-commented and clearly demonstrates the different methods for handling Basic Authentication.
• The accompanying documentation is also very well-written and provides a great explanation of the problem and the solutions.
• The use of environment variables for credentials is a good security practice.

I have one minor suggestion to make the code in the example slightly more efficient, but overall this is a great addition to the project.

[github-actions]

There is a problem with the Gemini CLI PR review. Please check the action logs for details.

[LionsAd]

nit - unrelated change

[jeremyandrews]

Agreed, but we missed it in the earlier PR that was already merged, and it feels like overkill to create a new PR for this change.

[LionsAd]

"you should use - this example implementation has limitations and is not meant for production usage."

-> needs to be emphasized stronger as this implementation has issues. (particularly: "this implementation lacks padding handling and input validation, which could lead to issues with edge cases".)

[LionsAd]

PR Review: Basic Authentication Example (#657)

🎯 Core Assessment

This is a valuable and well-executed contribution that addresses a real user need (GitHub issue #608). The PR provides comprehensive guidance on Basic Authentication with three practical approaches, excellent documentation, and working code that has been tested successfully.

📋 Recommendations by Category

🔧 Technical Improvements (Quick Fixes)

Environment Variable Parsing

• Problem: split(':') will break if password contains colons
• Solution: Use splitn(2, ':') for proper username:password parsing
• Effort: One-line change in credential parsing function

Code Consistency

• Problem: Uses println! instead of Goose logging patterns
• Solution: Replace with info!, warn! macros where appropriate
• Effort: Low - simple replacements for consistency

Documentation Check

• Problem: Potential GraphQL entry duplication in overview.md
• Solution: Verify no duplicate entries exist
• Effort: Quick documentation review

🎨 Design Discussions (Working Fine As-Is)

Base64 Implementation

• Current Approach: Custom base64_encode function for self-contained example
• Alternative: Use base64 crate as dev dependency
• Business Reality: Self-contained examples have educational value; current implementation works correctly and includes clear production guidance

Feature Flag Approach

• Current Approach: Wraps entire example in cookies feature gate
• Alternative: Only conditionally gate cookie_store(true) call
• Business Reality: Current approach provides clear user guidance and works well; over-optimization not needed

🚀 Enhancement Opportunities (Nice to Have)

Static Asset Demonstration

• Enhancement: Add validate_and_load_static_assets call to concretely show the static asset propagation benefit
• Current: Well-documented in comments and explanations
• Value: Would strengthen the practical demonstration

Educational Clarity

• Enhancement: Brief comment explaining why custom client approach specifically solves static asset authentication
• Current: Explained in documentation
• Value: Would reinforce the key insight

(Powered by Claude Code)

[LionsAd]

RTBM - but the base64 recommendation should be fixed. Other improvements COULD me made.