creds.go
func ParseAuthHeaders(r *http.Request) (*AuthCreds, error) {
	// according to the doc below oauth 2.0 bearer access token can
	// come with query parameter
	// http://self-issued.info/docs/draft-ietf-oauth-v2-bearer.html#query-param
	// we are going to support this
	if r.URL.Query().Get(AccessTokenQueryParam) != "" {
		return &AuthCreds{
			Type:     AuthBearer,
			Password: r.URL.Query().Get(AccessTokenQueryParam),
		}, nil
	}

	authHeader := r.Header.Get("Authorization")
	if authHeader == "" {
		return nil, trace.Wrap(&AccessDeniedError{Message: "unauthorized"})
	}

	auth := strings.SplitN(authHeader, " ", 2)

	if len(auth) != 2 {
		return nil, trace.Wrap(
			&ParameterError{
				Name:    "Authorization",
				Message: "invalid auth header"})
	}

	switch auth[0] {
	case AuthBasic:
		payload, err := base64.StdEncoding.DecodeString(auth[1])
		if err != nil {
			return nil, trace.Wrap(
				&ParameterError{
					Name:    "Authorization",
					Message: err.Error()})
		}
		pair := strings.SplitN(string(payload), ":", 2)
		if len(pair) != 2 {
			return nil, trace.Wrap(
				&ParameterError{
					Name:    "Authorization",
					Message: "bad header"})
		}
		return &AuthCreds{Type: AuthBasic, Username: pair[0], Password: pair[1]}, nil
	case AuthBearer:
		return &AuthCreds{Type: AuthBearer, Password: auth[1]}, nil
	}
	return nil, trace.Wrap(
		&ParameterError{
			Name:    "Authorization",
			Message: "unsupported auth scheme"})
}
func ParseAuthHeaders(r *http.Request) (*AuthCreds, error) {
	// according to the doc below oauth 2.0 bearer access token can
	// come with query parameter
	// http://self-issued.info/docs/draft-ietf-oauth-v2-bearer.html#query-param
	// we are going to support this
	if r.URL.Query().Get(AccessTokenQueryParam) != "" {
		return &AuthCreds{
			Type:     AuthBearer,
			Password: r.URL.Query().Get(AccessTokenQueryParam),
		}, nil
	}

	authHeader := r.Header.Get("Authorization")
	if authHeader == "" {
		return nil, trace.Wrap(&AccessDeniedError{Message: "unauthorized"})
	}

	auth := strings.SplitN(authHeader, " ", 2)

	if len(auth) != 2 {
		return nil, trace.Wrap(
			&ParameterError{
				Name:    "Authorization",
				Message: "invalid auth header"})
	}

	switch auth[0] {
	case AuthBasic:
		payload, err := base64.StdEncoding.DecodeString(auth[1])
		if err != nil {
			return nil, trace.Wrap(
				&ParameterError{
					Name:    "Authorization",
					Message: err.Error()})
		}
		pair := strings.SplitN(string(payload), ":", 2)
		if len(pair) != 2 {
			return nil, trace.Wrap(
				&ParameterError{
					Name:    "Authorization",
					Message: "bad header"})
		}
		return &AuthCreds{Type: AuthBasic, Username: pair[0], Password: pair[1]}, nil
	case AuthBearer:
		return &AuthCreds{Type: AuthBearer, Password: auth[1]}, nil
	}
	return nil, trace.Wrap(
		&ParameterError{
			Name:    "Authorization",
			Message: "unsupported auth scheme"})
}
// ParseAuthHeaders parses authentication headers from HTTP request
// it currently detects Bearer and Basic auth types