code: func (b *basicAuth) authenticate(r *http.Request) bool {
  	const basicScheme string = "Basic "
  
  	if r == nil {
  		return false
  	}
  
  	// In simple mode, prevent authentication with empty credentials if User is
  	// not set. Allow empty passwords to support non-password use-cases.
  	if b.opts.AuthFunc == nil && b.opts.User == "" {
  		return false
  	}
  
  	// Confirm the request is sending Basic Authentication credentials.
  	auth := r.Header.Get("Authorization")
  	if !strings.HasPrefix(auth, basicScheme) {
  		return false
  	}
  
  	// Get the plain-text username and password from the request.
  	// The first six characters are skipped - e.g. "Basic ".
  	str, err := base64.StdEncoding.DecodeString(auth[len(basicScheme):])
  	if err != nil {
  		return false
  	}
  
  	// Split on the first ":" character only, with any subsequent colons assumed to be part
  	// of the password. Note that the RFC2617 standard does not place any limitations on
  	// allowable characters in the password.
  	creds := bytes.SplitN(str, []byte(":"), 2)
  
  	if len(creds) != 2 {
  		return false
  	}
  
  	givenUser := string(creds[0])
  	givenPass := string(creds[1])
  
  	// Default to Simple mode if no AuthFunc is defined.
  	if b.opts.AuthFunc == nil {
  		b.opts.AuthFunc = b.simpleBasicAuthFunc
  	}
  
  	return b.opts.AuthFunc(givenUser, givenPass, r)
  }
docs: // authenticate retrieves and then validates the user:password combination provided in
  // the request header. Returns 'false' if the user has not successfully authenticated.