Spring Security HTTP basic authentication example

When HTTP basic authentication is configured, web browser will display a login dialog for user authentication. This tutorial show you how to configure HTTP basic authentication in Spring Security.


  <http>
	<intercept-url pattern="/welcome*" access="ROLE_USER" />
	<http-basic />
  </http>

Last Spring Security form-based login example will be reused, but switch authentication to support HTTP basic.

1. Spring Security

To enable HTTP basic, just change “form-login” to “http-basic” tag.


<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans" 
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
	http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
	http://www.springframework.org/schema/security
	http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">

	<!-- HTTP basic authentication in Spring Security -->
	<http>
		<intercept-url pattern="/welcome*" access="ROLE_USER" />
		<http-basic />
	</http>

	<authentication-manager>
	   <authentication-provider>
	       <user-service>
		   <user name="mkyong" password="123456" authorities="ROLE_USER" />
	       </user-service>
	   </authentication-provider>
	</authentication-manager>

</beans:beans>

Done, that’s all.

2. Demo

When access the secured URL, browser will display a login dialog box automatically.

URL : http://localhost:8080/SpringMVC/welcome

http basic example

Download Source Code

References

  1. Spring Security hello world example
  2. Spring Security form-based login example

About the Author

author image
mkyong
Founder of Mkyong.com, love Java and open source stuff. Follow him on Twitter, or befriend him on Facebook or Google Plus. If you like my tutorials, consider make a donation to these charities.

Comments

Leave a Reply

avatar
newest oldest most voted
Savani
Guest
Savani

Why I am not able to logout with this example ? When I click on ‘logout’ link, I see nothing:

eis
Guest
eis

only way this worked for me was by replacing the first ROLE_USER with isAuthenticated()

Supun Dharmarathne
Guest
Supun Dharmarathne
Sathesh
Guest
Sathesh

When will it ask for the credentials again if i have entered the correct credentials ??

Savani
Guest
Savani

Hey, Are you able to logout with this code? I was not.

srikanth
Guest
srikanth

Hi mkyong,

How can we integrate single sign-on with the spring security.

Thank you

Pianista
Guest
Pianista

Hi mkyong,

One question, is there a way to suppress this dialog on the browser from the server?

For example if we want to hide this resource to all the people that is not passing by default the AuthBasic headers on their requests.

Thank you

sooriyah
Guest
sooriyah

where can i find the /welcome usage…can u plz eplain me in detail..i am new to spring

David
Guest
David

Hi good morning, i want to create a web service and i use spring security, but i want to connect to a database and check for the existence user instead of using an xml. I hope you can tell how to configure that greetings.

BrahmaReddy
Guest
BrahmaReddy

will you please give spring insertion, selection, update of programs for struts, springs.
Thanks,
BrahmaReddy

Betlista
Guest
Betlista

Thanks for your post ;-)

Just small note – if you want to change “The server says:” part, you can specify realm in http tag


<http realm="My secured application">
...
</http>