Basic Authentication with Spring Security

Locking the door

Most APIs should not be open to everyone. Spring Security is the standard way to add login and access control. The remarkable thing: just adding the dependency instantly protects every endpoint.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Define your own user

The generated password is only for a first test. Define a real user with a small config class. HTTP Basic auth sends a username and password with each request.

@Configuration
public class SecurityConfig {

    @Bean
    public UserDetailsService users() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("secret123")
            .roles("ADMIN")
            .build();
        return new InMemoryUserDetailsManager(user);
    }

    @Bean
    public SecurityFilterChain chain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(a -> a.anyRequest().authenticated())
            .httpBasic(Customizer.withDefaults());   // use HTTP Basic auth
        return http.build();
    }
}

How a protected request flows, step by step

Here is exactly what happens, in order, when a request hits a secured endpoint — first without a login, then with one:

1. A request arrives at a protected endpoint, e.g. GET /products.
2. Spring Security checks for credentials (a username and password) in the request.
3. If there are none (or they are wrong), Spring stops the request and returns 401 Unauthorized — your controller never runs.
4. So the client retries with credentials, e.g. curl -u admin:secret123 ..., which sends the username and password using HTTP Basic.
5. Spring checks them against your user (admin / secret123). They match, so it lets the request through.
6. Your controller method runs and returns the data with a 200 OK — the same response as before, now only for logged-in callers.