Spring Security Basic Authentication

In this Spring Security tutorial, we will learn how to use Spring Security provided built-in Basic Authentication to secure the REST APIs.

Basic Authentication Overview

• Basic Auth is the most basic option to secure the REST APIs. 
• Basic Auth uses an HTTP header in order to provide the username and password when making a request to a server. 
• Basic Auth uses Base 64 encoded username and password in the header.
• Basic Authentication DO NOT use cookies, hence there is no concept of a session or logging out a user, which means each request has to carry that header in order to be authenticated.

Maven Dependency

In order to use Spring Security in the Spring Boot project, we need to add the below Maven dependency:

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>

Spring Security Configuration

Next, let's configure Spring Security to use basic in-memory authentication. Let's create SpringSecurityConfig class and add the following code to it:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SpringSecurityConfig {

    @Bean
    public static PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        http.csrf().disable()
                .authorizeHttpRequests((authorize) -> {
                    authorize.anyRequest().authenticated();
                }).httpBasic(Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService(){

        UserDetails ramesh = User.builder()
                .username("ramesh")
                .password(passwordEncoder().encode("password"))
                .roles("USER")
                .build();

        UserDetails admin = User.builder()
                .username("admin")
                .password(passwordEncoder().encode("admin"))
                .roles("ADMIN")
                .build();

        return new InMemoryUserDetailsManager(ramesh, admin);
    }
}

By default, Spring Security enables both form-based and HTTP basic authentication. Here we are using httpBasic() element to define only Basic Authentication inside the SecurityFilterChain bean:

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        http.csrf().disable()
                .authorizeHttpRequests((authorize) -> {
                    authorize.anyRequest().authenticated();
                }).httpBasic(Customizer.withDefaults());
        return http.build();
    }

In the below InMemoryUserDetailsManager Java Configuration, we have created two users and stored them in the InMemoryUserDetailsManager class object.

    @Bean
    public UserDetailsService userDetailsService(){

        UserDetails ramesh = User.builder()
                .username("ramesh")
                .password(passwordEncoder().encode("password"))
                .roles("USER")
                .build();

        UserDetails admin = User.builder()
                .username("admin")
                .password(passwordEncoder().encode("admin"))
                .roles("ADMIN")
                .build();

        return new InMemoryUserDetailsManager(ramesh, admin);
    }

Spring Security’s InMemoryUserDetailsManager implements UserDetailsService to provide support for username/password-based authentication that is stored in memory.

Note that we are using PasswordEncoder to encode the password. Spring Security’s PasswordEncoder interface is used to perform a one-way transformation of a password to let the password be stored securely. We are using BCryptPasswordEncoder class which implements the PasswordEncoder interface. The BCryptPasswordEncoder class implementation uses the widely supported bcrypt algorithm to hash the passwords.

    @Bean
    public static PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

    .password(passwordEncoder().encode("password"))

Create REST API

In order to test the above Spring security configuration, let's create a simple REST API and protect it using Spring Security. Well, if we add Spring security dependency to the Spring boot project then by default Spring Security secures all the application URLs. 

import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class WelComeController {

    @GetMapping("/greeting")
    public String greeting(Authentication authentication) {

        String userName = authentication.getName();

        return "Spring Security In-memory Authentication Example - Welcome " + userName;
    }
}

Testing REST API using Postman

In order to test the REST APIs, we have to pass a username and password in the header this is called a basic authentication.

Note that we are passing username and password as admin/admin:

Basic Auth uses Base 64 encoded username and password in the header.

If we don't pass the username and password, we will get 401 status. This is how Spring Security secures the REST APIs.

Conclusion

In this tutorial, we have seen how to configure Spring Security's built-in HTTP basic authentication to secure the REST APIs.

Related Tutorials

• Spring Security Basic Authentication

• Spring Security In-Memory Authentication

• Spring Security Form-Based Authentication

• Difference Between Basic Authentication and Form Based Authentication

• Spring Security Custom Login Page

• Spring Security Login Form Example with Database Authentication
  

• Spring Boot Login REST API

• Login and Registration REST API using Spring Boot, Spring Security, Hibernate, and MySQL Database

• Spring Boot User Registration and Login Example Tutorial