HTTP Authentication Validation

I have been using the HttpServer of this library to build a REST API along side a websocket event system for a service I am building. The current version works with Basic authentication perfectly fine and is a great way of limiting connections.

However, I wish to build on this and use a permission system that I have devised. This permission system is boiled down to a iidentity and a list of permissions in a lookup table. While the websocket behaviours make it easy to get the identity of a connection using this.Context.User, there is seems to be no such thing within the HttpServer class itself.

This is preventing my HTTP Get listeners from verifying a connection and their identity against my table of permissions. The HttpRequestEventArgs contains no information about the identity of the user, besides the raw authentication within the headers.

A solution to this would be to use the headers with a key, however I wish to avoid that for now and try to work out a pure http authentication way around it. Is there a way to do this?

Start by reading the HttpServer and HttpRequestEventArgs entry points, then compare them with the websocket behavior that exposes this.Context.User. Determine how HTTP GET listeners could access authenticated identity information beyond raw request headers. Done should provide a documented, consistent way for HTTP handlers to validate identity and permissions.