Security Top

I just announced the new Learn Spring Security course, including the full material focused on the new OAuth2 stack in Spring Security 5:


1. Overview

This tutorial will explain how to set up, configure, and customize Basic Authentication with Spring. We're going to build on top of the simple Spring MVC example, and secure the UI of the MVC application with the Basic Auth mechanism provided by Spring Security.

Further reading:

Spring Boot Security Auto-Configuration

A quick and practical guide to Spring Boot's default Spring Security configuration.

Spring Security Authentication Provider

How to Set Up a Custom Authentication Provider with Spring Security and the namespace configuration.

Spring Security Form Login

A Spring Login Example - How to Set Up a simple Login Form, a Basic Security XML Configuration and some more Advanced Configuration Techniques.

2. The Spring Security Configuration

We can configure Spring Security using Java config:

public class CustomWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    private MyBasicAuthenticationEntryPoint authenticationEntryPoint;

    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

    protected void configure(HttpSecurity http) throws Exception {

        http.addFilterAfter(new CustomFilter(),

    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();

Here we're using the httpBasic() element to define Basic Authentication inside the configure() method of a class that extends WebSecurityConfigurerAdapter.

We could achieve the same result using XML as well:

<http pattern="/securityNone" security="none"/>
<http use-expressions="true">
    <intercept-url pattern="/**" access="isAuthenticated()" />
    <http-basic />

            <user name="user1" password="{noop}user1Pass" authorities="ROLE_USER" />

What's relevant here is the <http-basic> element inside the main <http> element of the configuration. This is enough to enable Basic Authentication for the entire application. Since we're not focusing on the Authentication Manager in this tutorial, we'll use an in-memory manager with the user and password defined in plain text.

The web.xml of the web application enabling Spring Security has already been discussed in the Spring Logout tutorial.

3. Consuming the Secured Application

The curl command is our go-to tool for consuming the secured application.

First, let's try to request the /homepage.html without providing any security credentials:

curl -i http://localhost:8080/spring-security-rest-basic-auth/api/foos/1

We get back the expected 401 Unauthorized and the Authentication Challenge:

HTTP/1.1 401 Unauthorized
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=E5A8D3C16B65A0A007CFAACAEEE6916B; Path=/spring-security-mvc-basic-auth/; HttpOnly
WWW-Authenticate: Basic realm="Spring Security Application"
Content-Type: text/html;charset=utf-8
Content-Length: 1061
Date: Wed, 29 May 2013 15:14:08 GMT

Normally the browser would interpret this challenge and prompt us for credentials with a simple dialog, but since we're using curl, this isn't the case.

Now let's request the same resource, the homepage, but provide the credentials to access it as well:

curl -i --user user1:user1Pass 

As a result, the response from the server is 200 OK along with a Cookie:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=301225C7AE7C74B0892887389996785D; Path=/spring-security-mvc-basic-auth/; HttpOnly
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 90
Date: Wed, 29 May 2013 15:19:38 GMT

From the browser, we can consume the application normally; the only difference is that a login page is no longer a hard requirement since all browsers support Basic Authentication, and use a dialog to prompt the user for credentials.

4. Further Configuration – the Entry Point

By default, the BasicAuthenticationEntryPoint provisioned by Spring Security returns a full page for a 401 Unauthorized response back to the client. This HTML representation of the error renders well in a browser. Conversely, it's not well suited for other scenarios, such as a REST API where a json representation may be preferred.

The namespace is flexible enough for this new requirement as well.  To address this, the entry point can be overridden:

<http-basic entry-point-ref="myBasicAuthenticationEntryPoint" />

The new entry point is defined as a standard bean:

public class MyBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint {

    public void commence(
      HttpServletRequest request, HttpServletResponse response, AuthenticationException authEx) 
      throws IOException, ServletException {
        response.addHeader("WWW-Authenticate", "Basic realm="" + getRealmName() + """);
        PrintWriter writer = response.getWriter();
        writer.println("HTTP Status 401 - " + authEx.getMessage());

    public void afterPropertiesSet() throws Exception {

By writing directly to the HTTP Response, we now have full control over the format of the response body.

5. The Maven Dependencies

The Maven dependencies for Spring Security have been discussed before in the Spring Security with Maven article. We will need both spring-security-web and spring-security-config available at runtime.

6. Conclusion

In this article, we secured an MVC application with Spring Security and Basic Authentication. We discussed the XML configuration, and we consumed the application with simple curl commands. Finally, we took control of the exact error message format, moving from the standard HTML error page to a custom text or JSON format.

The full implementation of this article can be found in the GitHub project. This is a Maven-based project, so it should be easy to import and run as it is.

When the project runs locally, the sample HTML can be accessed at:


Security bottom

I just announced the new Learn Spring Security course, including the full material focused on the new OAuth2 stack in Spring Security 5:

Inline Feedbacks
View all comments
Comments are closed on this article!