Over a million developers have joined DZone.

Spring Security: Basic Authentication Example

DZone's Guide to

Spring Security: Basic Authentication Example

Learn the basics of Basic Authentication, and how to use Basic Authentication to add security to your Spring Boot application.

· Security Zone ·
Free Resource

Address your unique security needs at every stage of the software development life cycle. Brought to you in partnership with Synopsys.

In this post, we will discuss Basic Authentication and how to use it using Spring Security.

Basic Authentication

  • It’s the simplest of all techniques and probably the most used as well. You use login/password forms – it’s basic authentication only. You input your username and password and submit the form to the server, and the application identifies you as a user – you are then allowed to use the system – otherwise, you get an error.
  • The main problem with this security implementation is that credentials are propagated in a plain way from the client to the server. Credentials are merely encoded with Base64 in transit, but not encrypted or hashed in any way. This way, any sniffer could read the sent packages over the network.
  • HTTPS is, therefore, typically preferred over, or used in conjunction with, Basic Authentication, which makes the conversation with the web server entirely encrypted. The best part is that nobody can even guess from the outside that Basic Auth is taking place.

Let's create a simple Spring Boot application which Basic Authentication enabled. You can read my previous post on how to create Simple Spring Boot application, if not familiar with it.

Add Dependencies in Pom.xml

We will add a spring-boot-starter-security dependency to the pom.xml


Configurations for Basic Authentication

We need to register BasicAuthenticationFilter and BasicAuthenticationEntryPoint as a bean in the Spring context.

BasicAuthenticationFilter basicAuthFilter(AuthenticationManager authenticationManager, BasicAuthenticationEntryPoint basicAuthEntryPoint) {
  return new BasicAuthenticationFilter(authenticationManager, basicAuthEntryPoint());

BasicAuthenticationEntryPoint basicAuthEntryPoint() {
  BasicAuthenticationEntryPoint bauth = new BasicAuthenticationEntryPoint();
  return bauth;

Enabling Basic Authentication and Configuring Properties

Basic Authentication is by default enabled when you add spring-security in your classpath. You need to configure the username and password for basic authentication. Here are some of the security properties. You can see SecurityProperties for other properties that you can configure, like realm name, etc.

    enabled: true
    name: gaurav
    password: bytes

XML Based Configuration for Basic Authentication

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

        <intercept-url pattern="/*" access="ROLE_USER" />

        <!-- Adds Support for basic authentication -->

                <user name="gaurav" password="bytes" authorities="ROLE_USER" />

This is how to enable basic authentication in Spring Boot application using Spring Security. You can get the full working example code for basic authentication on Github.

Find out how Synopsys can help you build security and quality into your SDLC and supply chain. We offer application testing and remediation expertise, guidance for structuring a software security initiative, training, and professional services for a proactive approach to application security.

security ,basic authentication ,spring boot

Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}