HTTP Basic authentication in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is HTTP Basic authentication?

HTTP Basic authentication is a simple way to protect web resources by requiring a username and password sent in the HTTP header encoded in Base64.

intermediate

How does Spring Boot enable HTTP Basic authentication?

Spring Boot enables HTTP Basic authentication by configuring security settings, often using the @EnableWebSecurity annotation and setting up an AuthenticationManager with user details.

beginner

What header does the client send for HTTP Basic authentication?

The client sends the 'Authorization' header with the value 'Basic ' followed by the Base64 encoded string of 'username:password'.

intermediate

What happens if HTTP Basic authentication fails in Spring Boot?

If authentication fails, Spring Boot responds with HTTP status 401 Unauthorized and includes a 'WWW-Authenticate' header prompting the client to provide credentials.

beginner

Why is HTTP Basic authentication not recommended for production without HTTPS?

Because credentials are only Base64 encoded, not encrypted, they can be easily intercepted and read if sent over plain HTTP. HTTPS encrypts the entire connection to protect credentials.

Which HTTP header carries the credentials in HTTP Basic authentication?

A Authentication

B Authorization

C WWW-Authenticate

D Proxy-Authorization

The 'Authorization' header carries the credentials encoded in Base64 for HTTP Basic authentication.

In Spring Boot, which annotation is commonly used to enable web security including HTTP Basic?

A @EnableWebSecurity

B @SpringBootApplication

C @RestController

D @EnableAutoConfiguration

@EnableWebSecurity enables Spring Security’s web security support including HTTP Basic authentication.

What status code does the server return when HTTP Basic authentication fails?

A 400 Bad Request

B 403 Forbidden

C 401 Unauthorized

D 500 Internal Server Error

A 401 Unauthorized status code tells the client that authentication is required or failed.

How are credentials sent in HTTP Basic authentication?

A Hashed password in a cookie

B Encrypted username and password in the body

C Plain text username and password in URL parameters

D Base64 encoded username and password in the Authorization header

Credentials are Base64 encoded and sent in the Authorization header as 'Basic base64(username:password)'.

Why should HTTP Basic authentication be used with HTTPS?

A To encrypt credentials and protect them from interception

B To speed up authentication

C To avoid using passwords

D To allow anonymous access

HTTPS encrypts the entire connection, protecting the Base64 encoded credentials from being intercepted.

Explain how HTTP Basic authentication works in a Spring Boot application.

Think about the request header and server response.

Describe why it is important to use HTTPS with HTTP Basic authentication.

Consider what happens if data is sent over an unprotected network.