Authentication

ElegantOTA supports HTTP Basic Authentication. When it is enabled, the browser asks for a username and password before it opens the portal, and the device rejects update requests without valid credentials. This prevents unauthorized users from installing firmware on your device.

Enable authenticationCopy Anchor Link

Call setAuth() with a username and a password:

ElegantOTA.setAuth("username", "password");

Alternatively, pass the credentials to begin():

ElegantOTA.begin(&server, "username", "password");

Authentication is enabled only when both the username and the password are non-empty.

ExampleCopy Anchor Link

#include <ElegantOTA.h>

// ... web server declaration

void setup() {
  // ... connect to Wi-Fi

  ElegantOTA.begin(&server);
  ElegantOTA.setAuth("myUsername", "myPassword");

  server.begin();
}

void loop() {
  server.handleClient();
  ElegantOTA.loop();
}

Clear authenticationCopy Anchor Link

To disable authentication after it was set, call clearAuth():

ElegantOTA.clearAuth();

Protected endpointsCopy Anchor Link

When authentication is enabled, the following routes require credentials:

Use casesCopy Anchor Link

• Security: prevent unauthorized firmware or filesystem updates.
• Access control: assign unique credentials to each device so that only authorized personnel or systems can update it.
• Compliance: meet security standards that require authentication for device management interfaces.

Best practicesCopy Anchor Link

• Use strong, unique credentials for each device. Do not use default or easily guessed credentials.
• Store credentials securely and avoid hard-coding them in source code that is shared or published.
• Rotate credentials regularly.
• Test the configuration to confirm that the portal rejects requests without valid credentials.
• HTTP Basic Authentication sends credentials encoded, not encrypted. Use it on networks you trust.