Spring Security Basic Auth

Security is a paramount concern in today’s web applications, and implementing robust authentication mechanisms is a crucial aspect of ensuring the safety of user data. Spring Security, a powerful and customizable security framework for Java applications, provides various authentication options, one of which is Basic Authentication. In this post, we’ll delve into the fundamentals of Spring Security Basic Authentication, exploring its key concepts, implementation steps, and best practices.

Understanding Basic Authentication

What is Basic Authentication? Basic Authentication is a simple and widely used authentication mechanism where the client sends a username and password with each request. The credentials are typically sent as a base64-encoded string in the HTTP header. Despite its simplicity, Basic Authentication is effective for securing applications when used in conjunction with HTTPS.

Key Components of Basic Authentication:

1. User Credentials: Consists of a username and password.
2. Base64 Encoding: The credentials are encoded using Base64 before being sent in the HTTP header.

Implementing Basic Authentication in Spring Security

1. Add Spring Security Dependency:

Include the Spring Security dependency in your project’s build file (e.g., Maven or Gradle). Here’s an example using Maven:
In your project’s pom.xml file, add the following dependencies within the <dependencies> section:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
</dependencies>

2. Create SecurityConfig configuration class

Get Vipul Kumar’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Create a new Java class named SecurityConfig in your project.

package com.company;

import com.company.configuration.ServiceProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;


@Configuration
public class BasicAuthWebSecurityConfiguration {

    @Bean
    public InMemoryUserDetailsManager userDetailsService(ServiceProperties serviceProperties) {
        PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();

        UserDetails user = User
                .withUsername(serviceProperties.getBasicUsername())
                .password(encoder.encode(serviceProperties.getBasicPassword()))
                .roles("USER")
                .build();
        return new InMemoryUserDetailsManager(user);
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf()
                .disable()
                .authorizeHttpRequests()
                .anyRequest().authenticated()
                .and()
                .httpBasic();

        return http.build();
    }
}

Configuring In-Memory User Authentication

In the SecurityConfig class, we have a method called userDetailsService(), which helps set up a user stored in the computer’s memory. This method is marked with the @Bean tag.

To create this user, we used the User.builder() method, specifying the username, password, and role. In this example, We have basicUserName and basicPassword variable, value being configured in property file and the role is “USER.”

The InMemoryUserDetailsManager is then set up with the user details we created. By making these changes, the application will now use the given username and password for logging in, instead of creating a random temporary password. Users can adjust the username, password, and role based on their needs.

This setup ensures that Spring Security is now using basic authentication for a user. Users can access the server using the provided credentials, without dealing with a temporary password.