Basic authentication

As explained in Spring Security in Action, Second Edition

HTTP Basic authentication is an HTTP authentication scheme that transmits a username and password using an Authorization header value containing Base64-encoded credentials.

Basic authentication lets a web client authenticate with a username and password sent in the HTTP Authorization header. The header contains the Basic prefix followed by a Base64-encoded username-and-password string separated by a colon. section 2.2

Base64 only encodes the credentials; it does not encrypt or hash them. Use HTTPS to provide confidentiality while the request is in transit. section 2.2

A small Spring application can use Basic authentication with little configuration:

• Adding the Spring Security dependency causes Spring Boot to secure endpoints, create default authentication settings, and generate a password at startup. section 2.1
• The default configuration requires an authenticated user for every endpoint and uses a default UserDetailsService, PasswordEncoder, and authentication provider. section 2.2
• Define a SecurityFilterChain when endpoint authorization or authentication behavior must change; use httpBasic() to select Basic authentication explicitly. section 2.3.2 section 6.3.1
• Apply authenticated() to require credentials or permitAll() to make matching endpoints accessible without them. section 2.3.2

Calling a protected REST endpoint

For a /hello endpoint, a request without credentials returns 401 Unauthorized. Supplying credentials with curl, either through -u user:password or an Authorization header containing Basic and the Base64 value, returns the endpoint response. section 2.1

Basic authentication can be customized through HttpBasicConfigurer, including the protection-space realm name and the response for failed authentication. An AuthenticationEntryPoint can add response headers or produce a custom 401 response. section 6.3.1

Figure 2.1 Our initial application employs HTTP Basic for user authentication and authorization when accessing an endpoint. It offers a REST endpoint at a specified route (/hello). Upon a successful request, it issues an HTTP 200 status message along with a response body. This instance illustrates the default authentication and authorization mechanisms set up by Spring Security.

Trace the protected REST endpoint from authentication and authorization through a successful HTTP 200 response. section 2.1

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains the header format, Base64 limitation, Spring defaults, endpoint rules, HTTPS, realms, and custom 401 handling.

Examples

Demonstrates a protected /hello REST endpoint, curl credential forms, Base64 encoding, generated passwords, realms, and custom 401 headers.

What it assumes

Assumes basic Spring and Java knowledge while introducing default users, password encoding, authentication providers, and SecurityFilterChain configuration.

What you can do after

Operate and configure Spring Security Basic authentication, test protected endpoints, require or permit access, and customize failed responses.

How it connects

Connects HTTP Basic authentication with HTTPS, HTTP authorization headers, Spring Security, UserDetailsService, PasswordEncoder, and endpoint authorization.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityBasic authentication is an HTTP authentication method that transmits a username and password in an HTTP header, typically encoded but not inherently encrypted.
• 

  liveBookmanning.com
  Logs and TelemetryBasic authentication is an HTTP authentication scheme that transmits a username and password in an encoded authorization header.

Compare how 3 books explain basic authentication →

Related concepts

• OAuthalternative to · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
• bearer authenticationcontrasts with · Bearer authentication is an authentication scheme in which presenting a bearer token is sufficient to use the access or authorization granted by that token.
• password authenticationuses · Password authentication is an authentication method that verifies a claimed identity or access by checking a supplied secret password or passphrase.
• RESTused by · REST is an architectural style for distributed hypermedia systems that organizes interactions around resources and representations through constraints including a uniform interface, stateless communication, cacheability, and layered components.
• HTTPSuses · HTTPS is HTTP carried over TLS, which provides encryption and endpoint authentication for network communication.
• Actuator endpointconfigures · An Actuator endpoint is a Spring Boot Actuator management interface that exposes operational data or operations through supported communication mechanisms.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.