Replace basic authentication with a password page and a cookie.

[frankieroberto]

Description

This replaces the "basic authentication" (a browser popup asking for a username and password) with a redirect to a page asking users to enter a password.

As well as being more user-friendly, this also helps avoid an issue where some corporate networks have turned of basic authentication in the Edge browser.

The code here heavily borrows from the work done by the GOV.UK Prototype Kit team in alphagov/govuk-prototype-kit#1182

Fixes #323

Screenshot

Checklist

• Tested against our testing policy (Resolution, Browser & Accessibility)
• CHANGELOG entry

[frankieroberto]

@anandamaryon1 @edwardhorsford @paulrobertlloyd fancy testing this out, including deploying it some hosting environments like Heroku?

[frankieroberto]

Possibly the password environment variable should be PROTOTYPE_PASSWORD not PASSWORD, for backwards-compatibility with the current kit? 🤔

[anandamaryon1]

Looks like this how-to guidance will need to be updated to reflect this work: https://nhsuk-prototype-kit.azurewebsites.net/docs/how-tos/publish-your-prototype-online

[frankieroberto]

@anandamaryon1 yep! And I think we would also have to maintain guidance on how to set the username and password on previous versions (as not everyone will upgrade quickly?)

In which case, I think we could do something like this:

When running the prototype kit online, you must set password to stop anyone accidentally finding your prototype and mistaking it for a real service.

To do this, set an environment variable (called ‘Config vars’ on Heroku):

PROTOTYPE_PASSWORD=yourpassword123

If you are using an older version of the NHS Prototype Kit (before x.x) then you will also need to set a username. This can be the same of your service. For example:

PROTOTYPE_USERNAME=nameofservice

[sarawilcox]

I'll see if I can find some designers who might be able to test this.

[Tosin-Balogun]

@frankieroberto thank you for this. Just to save me a bit of time, are you able to share a heroku or github page preview so I can see how it works?