HTTP Basic authentication in Spring Boot - Mini Project: Build & Apply

HTTP Basic authentication

📖 Scenario: You are building a simple Spring Boot web application that needs to protect its endpoints with HTTP Basic authentication. This means users must provide a username and password to access the app.

🎯 Goal: Set up HTTP Basic authentication in a Spring Boot app to secure all endpoints with a username and password.

📋 What You'll Learn

Create a Spring Boot application class

Add a security configuration class to enable HTTP Basic authentication

Configure an in-memory user with username user and password password

Secure all HTTP endpoints so they require authentication

💡 Why This Matters

🌍 Real World

HTTP Basic authentication is a simple way to protect web applications by requiring a username and password. It is often used for internal tools or APIs.

💼 Career

Understanding how to configure HTTP Basic authentication in Spring Boot is important for backend developers to secure applications quickly and effectively.

1

Create the Spring Boot application class

Create a class called BasicAuthApplication with the @SpringBootApplication annotation and a main method that runs SpringApplication.run(BasicAuthApplication.class, args).

Spring Boot

// Your code here

Hint

This is the main class to start your Spring Boot app. Use @SpringBootApplication and a main method.

2

Add a security configuration class

Create a class called SecurityConfig annotated with @Configuration and @EnableWebSecurity. Inside, define a SecurityFilterChain bean method called filterChain that takes HttpSecurity http as a parameter.

Spring Boot

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.context.annotation.Bean;

// Your code here

Hint

This class will hold your security setup. Use @Configuration and @EnableWebSecurity. Define a SecurityFilterChain bean method.

3

Configure HTTP Basic authentication and require authentication for all requests

In the filterChain method, configure http to require authentication for any request and enable HTTP Basic authentication by calling http.authorizeHttpRequests().anyRequest().authenticated() and http.httpBasic(). Then return http.build().

Spring Boot

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class BasicAuthApplication {
    public static void main(String[] args) {
        SpringApplication.run(BasicAuthApplication.class, args);
    }
}

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.context.annotation.Bean;

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        // Configure HTTP Basic authentication and require authentication for all requests
        // Your code here
    }
}

Hint

Use http.authorizeHttpRequests().anyRequest().authenticated() to require login for all requests and http.httpBasic() to enable HTTP Basic authentication.

4

Add an in-memory user with username and password

In the SecurityConfig class, add a UserDetailsService bean method called users that returns an InMemoryUserDetailsManager with a user having username user, password password, and role USER. Use User.withDefaultPasswordEncoder() to create the user.

Spring Boot

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class BasicAuthApplication {
    public static void main(String[] args) {
        SpringApplication.run(BasicAuthApplication.class, args);
    }
}

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.context.annotation.Bean;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.core.userdetails.User;

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests().anyRequest().authenticated();
        http.httpBasic();
        return http.build();
    }

    // Your code here
}

Hint

Create a UserDetailsService bean that returns an InMemoryUserDetailsManager with a user named user and password password. Use User.withDefaultPasswordEncoder() to build the user.

Practice

1. What does HTTP Basic authentication do in a Spring Boot application?

easy

A. It protects web resources by requiring a username and password.

B. It encrypts all data sent between client and server automatically.

C. It allows users to log in without any credentials.

D. It disables security for all endpoints.

Solution

1. Step 1: Understand HTTP Basic authentication purpose

   HTTP Basic authentication requires users to provide a username and password to access protected resources.

2. Step 2: Identify what it does in Spring Boot

   Spring Boot uses HTTP Basic to prompt for credentials before allowing access to endpoints.

3. Final Answer:

   It protects web resources by requiring a username and password. -> Option A

4. Quick Check:

   HTTP Basic authentication = username and password protection [OK]

Hint: Remember HTTP Basic always asks for username and password [OK]

Common Mistakes:

• Thinking HTTP Basic encrypts data by itself
• Assuming it allows access without credentials
• Confusing it with disabling security

2. Which of the following is the correct way to enable HTTP Basic authentication in a Spring Security configuration?

easy

A. http.authBasic();

B. http.enableBasicAuth();

C. http.httpBasic();

D. http.basicAuthentication();

Solution

1. Step 1: Recall Spring Security method for HTTP Basic

   The correct method to enable HTTP Basic is httpBasic() on the HttpSecurity object.

2. Step 2: Match the exact method name

   Only http.httpBasic(); matches the official Spring Security syntax.

3. Final Answer:

   http.httpBasic(); -> Option C

4. Quick Check:

   Enable HTTP Basic = http.httpBasic() [OK]

Hint: Look for exact method name: httpBasic() [OK]

Common Mistakes:

• Using incorrect method names like enableBasicAuth()
• Confusing method names with similar words
• Missing parentheses in method call

3. Given this Spring Security configuration snippet, what happens when a user accesses a protected endpoint?

http
  .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
  .httpBasic();

medium

A. The user can access the endpoint without any credentials.

B. The user is redirected to a custom login page.

C. The server returns a 404 Not Found error.

D. The user is prompted to enter username and password via browser popup.

Solution

1. Step 1: Analyze the configuration

   The configuration requires authentication for any request and enables HTTP Basic authentication.

2. Step 2: Understand HTTP Basic behavior

   HTTP Basic triggers a browser popup asking for username and password when accessing protected resources.

3. Final Answer:

   The user is prompted to enter username and password via browser popup. -> Option D

4. Quick Check:

   httpBasic() = browser login popup [OK]

Hint: httpBasic() triggers browser popup for credentials [OK]

Common Mistakes:

• Thinking it redirects to a login page
• Assuming no credentials are needed
• Confusing 404 error with authentication failure

4. Identify the error in this Spring Security configuration for HTTP Basic authentication:

http
  .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
  .httpbasic();

medium

A. Method name should be httpBasic() with capital B.

B. authorizeHttpRequests() should be authorizeRequests().

C. authenticated() should be permitAll().

D. No error, configuration is correct.

Solution

1. Step 1: Check method names carefully

   The method to enable HTTP Basic is httpBasic() with a capital B, not httpbasic().

2. Step 2: Verify other methods

   authorizeHttpRequests() is correct in Spring Security 6+, and authenticated() is appropriate to require login.

3. Final Answer:

   Method name should be httpBasic() with capital B. -> Option A

4. Quick Check:

   Method names are case-sensitive = httpBasic() [OK]

Hint: Check method capitalization carefully [OK]

Common Mistakes:

• Using wrong method case like httpbasic()
• Confusing authorizeHttpRequests with older authorizeRequests
• Changing authenticated() to permitAll() incorrectly

5. You want to secure your Spring Boot REST API with HTTP Basic authentication but only for the endpoints under /admin/**. Which configuration snippet correctly applies HTTP Basic only to those endpoints?

hard

A. http.httpBasic().authorizeHttpRequests(auth -> auth.anyRequest().authenticated());

B. http.authorizeHttpRequests(auth -> auth.requestMatchers("/admin/**").authenticated().anyRequest().permitAll()).httpBasic();

C. http.authorizeHttpRequests(auth -> auth.anyRequest().permitAll()).httpBasic();

D. http.authorizeHttpRequests(auth -> auth.requestMatchers("/admin/**").permitAll()).httpBasic();

Solution

1. Step 1: Understand the requirement

   Only endpoints matching /admin/** should require authentication; others should be open.

2. Step 2: Analyze each option

   http.authorizeHttpRequests(auth -> auth.requestMatchers("/admin/**").authenticated().anyRequest().permitAll()).httpBasic(); correctly requires authentication for /admin/** and permits all other requests. Other options either require authentication for all requests, permit all requests, or incorrectly permit the /admin/** paths.

3. Final Answer:

   http.authorizeHttpRequests(auth -> auth.requestMatchers("/admin/**").authenticated().anyRequest().permitAll()).httpBasic(); -> Option B

4. Quick Check:

   Secure only /admin/** = authenticated() on matcher + permitAll() others [OK]

Hint: Use requestMatchers for specific paths, then set auth [OK]

Common Mistakes:

• Applying authentication to all endpoints instead of specific ones
• Permitting admin endpoints by mistake
• Misordering authorizeHttpRequests and httpBasic calls