HTTP Basic authentication in Spring Boot - Step-by-Step Execution

Concept Flow - HTTP Basic authentication

Client sends HTTP request

↓

Server checks Authorization header

↓

Is header present?

No→Respond 401 Unauthorized

Yes↓

Decode Base64 credentials

↓

Validate username and password

↓

Are credentials valid?

No→Respond 401 Unauthorized

Yes↓

Grant access to requested resource

The client sends a request with credentials encoded in the Authorization header. The server decodes and validates them, then allows or denies access.

Execution Sample

Spring Boot

http.httpBasic();
// Client sends header: Authorization: Basic base64(user:pass)
// Server decodes and checks credentials
// If valid, request proceeds
// If invalid, server responds 401

This code enables HTTP Basic authentication in Spring Boot, where the server checks the Authorization header for valid credentials.

Execution Table

Step	Action	Input/Condition	Result	Server Response
1	Client sends HTTP request	No Authorization header	Server checks header	401 Unauthorized
2	Client sends HTTP request	Authorization: Basic dXNlcjpwYXNz	Server decodes Base64 to 'user:pass'	Proceed to validation
3	Server validates credentials	Username='user', Password='pass'	Credentials valid?	If valid, grant access; else 401
4	Credentials valid	Yes	Access granted to resource	200 OK with resource
5	Credentials valid	No	Access denied	401 Unauthorized

💡 Execution stops when server either grants access (200 OK) or denies with 401 Unauthorized.

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
Authorization Header	None	Basic dXNlcjpwYXNz	Basic dXNlcjpwYXNz	Used for validation
Decoded Credentials	None	'user:pass'	'user:pass'	Checked for validity
Credentials Valid?	Unknown	Unknown	True or False	Determines access

Key Moments - 3 Insights

Why does the server respond with 401 Unauthorized if the Authorization header is missing?

Because the server requires credentials to allow access. Without the header, it cannot authenticate the client, so it denies access as shown in execution_table step 1.

How does the server get the username and password from the Authorization header?

The server decodes the Base64 string in the header to get 'username:password', as shown in execution_table step 2.

What happens if the credentials are incorrect?

The server responds with 401 Unauthorized and denies access, as shown in execution_table step 5.

Visual Quiz - 3 Questions

Look at the execution table, what is the server response when the Authorization header is missing?

A 200 OK

B 403 Forbidden

C 401 Unauthorized

D 500 Internal Server Error

💡 Hint

Check step 1 in the execution_table where no Authorization header is present.

At which step does the server decode the Base64 credentials?

A Step 2

B Step 1

C Step 3

D Step 4

💡 Hint

Look at the 'Action' and 'Result' columns in execution_table step 2.

If the credentials are invalid, what will the final server response be?

A 200 OK

B 401 Unauthorized

C 404 Not Found

D 302 Redirect

💡 Hint

See execution_table step 5 for invalid credentials.

Concept Snapshot

HTTP Basic authentication sends username and password encoded in the Authorization header.
Server decodes Base64 string to get credentials.
If credentials are valid, access is granted; otherwise, 401 Unauthorized is returned.
In Spring Boot, enable with http.httpBasic().
Always use HTTPS to protect credentials.

Full Transcript

HTTP Basic authentication works by the client sending an HTTP request with an Authorization header containing the username and password encoded in Base64. The server checks if this header is present. If missing, it responds with 401 Unauthorized. If present, the server decodes the Base64 string to extract the username and password. Then it validates these credentials. If valid, the server grants access to the requested resource and responds with 200 OK. If invalid, it responds again with 401 Unauthorized. In Spring Boot, this is enabled by calling http.httpBasic() in the security configuration. It is important to use HTTPS to keep credentials safe during transmission.