Spring Security HTTP basic authentication example
When HTTP basic authentication is configured, web browser will display a login dialog for user authentication. This tutorial show you how to configure HTTP basic authentication in Spring Security.
<http>
<intercept-url pattern="/welcome*" access="ROLE_USER" />
<http-basic />
</http>
Last Spring Security form-based login example will be reused, but switch authentication to support HTTP basic.
1. Spring Security
To enable HTTP basic, just change “form-login” to “http-basic” tag.
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">
<!-- HTTP basic authentication in Spring Security -->
<http>
<intercept-url pattern="/welcome*" access="ROLE_USER" />
<http-basic />
</http>
<authentication-manager>
<authentication-provider>
<user-service>
<user name="mkyong" password="123456" authorities="ROLE_USER" />
</user-service>
</authentication-provider>
</authentication-manager>
</beans:beans>
Done, that’s all.
2. Demo
When access the secured URL, browser will display a login dialog box automatically.
URL : http://localhost:8080/SpringMVC/welcome
Download Source Code
Download it – Spring-Security-HTTP-Basic-Authentication-Example.zip (9 KB)
thank you.
Why I am not able to logout with this example ? When I click on ‘logout’ link, I see nothing:
only way this worked for me was by replacing the first ROLE_USER with isAuthenticated()
Thanks for the post 🙂
Here is the Java Configuration..
https://supundharmarathne.wordpress.com/2015/02/17/spring-security-basic-http-authentication/
When will it ask for the credentials again if i have entered the correct credentials ??
Hey, Are you able to logout with this code? I was not.
Hi mkyong,
How can we integrate single sign-on with the spring security.
Thank you
Hi mkyong,
One question, is there a way to suppress this dialog on the browser from the server?
For example if we want to hide this resource to all the people that is not passing by default the AuthBasic headers on their requests.
Thank you
where can i find the /welcome usage…can u plz eplain me in detail..i am new to spring
Hi good morning, i want to create a web service and i use spring security, but i want to connect to a database and check for the existence user instead of using an xml. I hope you can tell how to configure that greetings.
will you please give spring insertion, selection, update of programs for struts, springs.
Thanks,
BrahmaReddy
Thanks for your post 😉
Just small note – if you want to change “The server says:” part, you can specify realm in http tag