liveBook · Manning

Static key

As explained in Spring Security in Action, Second Edition

A static key is a fixed secret value presented by a client to identify itself to an application.

A static key is a fixed secret that a client sends in an HTTP header, commonly Authorization. The application compares it with a stored value, often kept in a database or secrets vault, and accepts matching requests. This provides weak authentication, but remains simple and fast for backend-to-backend calls. section 5.4

Request check

Configure authorization.key=SD9cICjl1e, then call curl -H "Authorization:SD9cICjl1e" http://localhost:8080/hello. A matching request returns Hello!; a request without the header returns HTTP 401.

How Spring Security in Action, Second Edition covers it

How deep it goes
Implements header comparison, failure handling, filter placement, configuration, and curl verification without detailing cryptographic protection.
Examples
Uses an Authorization header, an authorization.key property, a Spring filter, curl requests, and Hello!/HTTP 401 responses.
What you can do after
Operate/configure it by implementing a Spring filter, positioning it in the security chain, and testing accepted and rejected requests.
How it connects
Contrasts with HTTP Basic authentication, symmetric request signing, asymmetric keys, and one-time passwords.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.