HTTP Authorization header

As explained in Spring Security in Action, Second Edition

The HTTP Authorization header carries credentials or authentication tokens in an HTTP request.

The HTTP Authorization header carries credentials for authenticating an HTTP request. With Spring Security's default HTTP Basic access authentication, its value begins with Basic and continues with the Base64 encoding of username:password. section 2.2

A practical Spring Security request follows this sequence:

• Omit the header and the protected endpoint responds with HTTP 401 Unauthorized. section 2.1
• Supply valid credentials and the request reaches the endpoint, producing HTTP 200 and its response body. section 2.1
• Treat Base64 as encoding rather than encryption or hashing; use HTTPS to protect credentials in transit. section 2.2

Calling a protected endpoint

curl -H "Authorization: Basic dXNlcjo5M2EwMWNmMC03OTRiLTRiOTgtODZlZi01NDg2MGYzNmY3ZjM=" http://localhost:8080/hello returns Hello! The same credentials can be supplied with curl's -u option. section 2.1

Figure 2.1 Our initial application employs HTTP Basic for user authentication and authorization when accessing an endpoint. It offers a REST endpoint at a specified route (/hello). Upon a successful request, it issues an HTTP 200 status message along with a response body. This instance illustrates the default authentication and authorization mechanisms set up by Spring Security.

Trace the default Spring Security flow from an HTTP Basic request to authentication, authorization, and the protected REST response. section 2.1

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains header construction, Base64 encoding, curl usage, 401 failure, and HTTPS limits, but does not detail token schemes.

Examples

Uses a protected /hello endpoint, curl -u credentials, explicit Authorization construction, and a generated Spring Security password.

What it assumes

Assumes basic HTTP requests and Spring applications while teaching the header format and authentication failure behavior directly.

What you can do after

Operate a protected Spring endpoint by constructing and testing an HTTP Basic Authorization header with curl.

How it connects

Connects HTTP Basic authentication with Spring Security, authentication, authorization, Base64, and HTTPS.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Building Web APIs with ASP.NET CoreThe Authorization header is an HTTP request header that carries credentials or authentication information for the requested resource.

Compare how 2 books explain HTTP Authorization header →

Related concepts

• API keyused by · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• JSON Web Tokenused by · A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
• bearer authenticationused by · Bearer authentication is an authentication scheme in which presenting a bearer token is sufficient to use the access or authorization granted by that token.
• interceptorused by · An interceptor is a middleware component that observes, modifies, or instruments requests, responses, or operations before, during, or after execution.
• access tokenuses · An access token is a security credential that conveys a client's authorization to access protected resources or perform permitted operations.
• request messagepart of · An HTTP request is a message sent by a client to a server that specifies a method and target and may include headers and a body.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.