app, user, pass end ! def call(env) if authenticated?(env['HTTP_AUTHORIZATION']) @app.call(env) else [403, {}, "Go Away!"] end end ! def authenticated?(auth) return false unless auth _, token = auth.split(' ') user, pass = token.unpack('m*').first.split(':') (user == @user && pass == @pass) end end ! app = ->(env) {[200, {}, 'Hello, World!']} with_auth = Rack::Auth::Basic.new(app, 'paulh', 'hello') Rack::Handler::Thin.run(with_auth) Our app doesn't need to care about Authentication