Spring Security Basic Authentication Example using Annotation

This tutorial shows you how to create Spring Security Basic Authentication Example using Annotation. With this example you are easy to secure your application using Basic Authentication.

You are similar to the REST API via the tutorial Spring MVC RESTFul Web Service CRUD Example. Now i make sure that you are concerned about the security issue of this application. How can we secure this application? Of course we can do that by using Basic Authentication or OAuth2 security solution.

This example will inherit from source code of the tutorial Spring MVC RESTFul Web Service CRUD Example.

Other interesting posts you may like

Table of conents:
1. Configure Basic Authentication with Spring Security
2. Spring REST API
3. Deploy Spring Security Basic Authentication Example

Configure Basic Authentication with Spring Security
Here, we have to enable the Basic Authentication in Spring Security via two steps.

1. Configures HTTP Basic authentication.

package com.javabycode.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

	private static String REALM = "EXAMPLE_REALM";

	@Autowired
	public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
		auth.inMemoryAuthentication().withUser("javabycode").password("123456").roles("USER");
		auth.inMemoryAuthentication().withUser("admin").password("admin123").roles("ADMIN");
	}

	@Override
	protected void configure(HttpSecurity http) throws Exception {

		http.csrf().disable().authorizeRequests().antMatchers("/user/**").hasRole("ADMIN").and().httpBasic()
				.realmName(REALM).authenticationEntryPoint(getBasicAuthEntryPoint())
				// No need session.
				.and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
	}

	@Bean
	public MyBasicAuthenticationEntryPoint getBasicAuthEntryPoint() {
		return new MyBasicAuthenticationEntryPoint();
	}

	/* To allow Pre-flight [OPTIONS] request from browser */
	@Override
	public void configure(WebSecurity web) throws Exception {
		web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
	}
}

package com.javabycode.security;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.http.HttpMethod;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.builders.WebSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.config.http.SessionCreationPolicy;

@Configuration

@EnableWebSecurity

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

private static String REALM = "EXAMPLE_REALM";

@Autowired

public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {

auth.inMemoryAuthentication().withUser("javabycode").password("123456").roles("USER");

auth.inMemoryAuthentication().withUser("admin").password("admin123").roles("ADMIN");

}

@Override

protected void configure(HttpSecurity http) throws Exception {

http.csrf().disable().authorizeRequests().antMatchers("/user/**").hasRole("ADMIN").and().httpBasic()

.realmName(REALM).authenticationEntryPoint(getBasicAuthEntryPoint())

// No need session.

.and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

}

@Bean

public MyBasicAuthenticationEntryPoint getBasicAuthEntryPoint() {

return new MyBasicAuthenticationEntryPoint();

}

/* To allow Pre-flight [OPTIONS] request from browser */

@Override

public void configure(WebSecurity web) throws Exception {

web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");

}

2. Configure authentication entry point: this entry point will be triggered if the authentication fails and it will response to client error message. Actually, we create the MyBasicAuthenticationEntryPoint class which is extended from BasicAuthenticationEntryPoint for customizing the response message.

package com.javabycode.security;

import java.io.IOException;
import java.io.PrintWriter;
 
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
 
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
 
public class MyBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint {
 
    @Override
    public void commence(final HttpServletRequest request, 
            final HttpServletResponse response, 
            final AuthenticationException authException) throws IOException, ServletException {
        //Authentication failed
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.addHeader("WWW-Authenticate", "Basic realm=" + getRealmName() + "");
         
        PrintWriter writer = response.getWriter();
        writer.println("HTTP Status 401 : " + authException.getMessage());
    }
     
    @Override
    public void afterPropertiesSet() throws Exception {
        setRealmName("EXAMPLE_REALM");
        super.afterPropertiesSet();
    }
}

package com.javabycode.security;

import java.io.IOException;

import java.io.PrintWriter;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.AuthenticationException;

import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;

public class MyBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint {

@Override

public void commence(final HttpServletRequest request,

final HttpServletResponse response,

final AuthenticationException authException) throws IOException, ServletException {

//Authentication failed

response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);

response.addHeader("WWW-Authenticate", "Basic realm=" + getRealmName() + "");

PrintWriter writer = response.getWriter();

writer.println("HTTP Status 401 : " + authException.getMessage());

}

@Override

public void afterPropertiesSet() throws Exception {

setRealmName("EXAMPLE_REALM");

super.afterPropertiesSet();

}

Spring REST API
Here, we reuse source code of the tutorial Spring MVC RESTFul Web Service CRUD Example to build Spring REST API. So we don’t introduce about how to create Rest Controller here. Notices that we have to put two above classes and spring security dependencies into the current source code. You can refer to the completely project by downloading attachment.

Deploy Spring Security Basic Authentication Example
After building the project by maven we deploy the file war on application server (Tomcat 8 for example). Run the URL http://localhost:8080/spring-basic-authentication/fruits and the authentication popup appears like below

Spring Security Basic Authentication Example using Annotation json