1. Overview

This article contains Spring boot 2 Spring security 5 in-memory Basic Authentication Example. Spring boot 2 by default supports Spring Security 5. This example contains in-memory authentication with static username and password. We will learn how we can secure Spring boot API using spring security 5 basic authentication.

 2. Example

Spring security 5 in-memory Basic Authentication Example

Spring security 5 in-memory Basic Authentication Example

2.1 pom.xml

We have used here spring-boot-starter-parent-2.0.0.RELEASE version for spring boot 2. Spring boot 2 by default support Spring security 5 so no need to maintain version in spring-boot-starter-security dependency.

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <description>Spring security 5 in-memory Basic Authentication Example</description>
    <!-- Inherit defaults from Spring Boot -->


    <!-- Package as an executable jar -->

2.2 SpringBootConfig

It normal like other spring boot application.

package com.javadeveloperzone;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.ComponentScan;

 * Created by JavaDeveloperZone on 07-04-2018.

@ComponentScan // Using a root package also allows the @ComponentScan annotation to be used without needing to specify a basePackage attribute
public class SpringBootConfig {
    public static void main(String[] args) throws Exception {
        SpringApplication.run(SpringBootConfig.class, args);            // it wil start application

2.3 SecurityConfiguration

After spring security 5 multiple password encryption is supported. So password will be stored like {EncoderType}PasswordText . If the password is not encrypted then {noop} must be there, {noop}indicates plain text password. There is no encryption written before password then it will throw an exception  java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id "null" while the user tries to log in.

Let’s define a configuration which extends  WebSecurityConfigurerAdapter where:

Using HttpSecurity we can define security type as basic or form-based authentication, exclude or include URLs for security.  Here we have used in-memory authentication, generally, if we have few users then we can use in-memory authentication otherwise database authentication is preferable.

package com.javadeveloperzone;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

 * Created by JavaDeveloperZone on 07-04-2018.
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired      // here is configuration related to spring boot basic authentication
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()                   // for inMemory Authentication
            .withUser("zone").password("{noop}password").roles("USER")          // {noop} for plain text

    protected void configure(HttpSecurity http) throws Exception {
                .httpBasic()                      // it indicate basic authentication is requires
                .antMatchers( "/index").permitAll() // /index will be accessible directly no need of any authentication
                .anyRequest().authenticated();    // it's indicate all request will be secure
                 http.csrf().disable();      // to disable csrf

2.4 DemoController

This controller contains two API one is /index which does not contain any security. another one is secureAPI to access it requires basic authentication.

package com.javadeveloperzone.controller;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

 * Created by JavaDeveloperZone on 07-04-2018.
@RestController             // to generate JSON Response
public class DemoController {

    @GetMapping(value = "index")
    public String index(){
        return "This is index API and It's without Security";

    @GetMapping(value = "secureAPI")
    public String secureAPI() {
        return "Spring security 5 in-memory Basic Authentication Example";

2.5 Output:

Let’s access secure API with basic authentication using POSTMAN tools :  http://localhost:8080/secureAPI


Spring security 5 in-memory Basic Authentication Example - Call Secure API

Spring security 5 in-memory Basic Authentication Example – Call Secure API


If anyone tries to access http://localhost:8080/secureAPI without basic authentication then it will throw 401 (Unauthorized) like:

Whitelabel Error Page
This application has no explicit mapping for /error, so you are seeing this as a fallback.

Sat Apr 07 10:40:19 IST 2018
There was an unexpected error (type=Unauthorized, status=401).

3. Conclusion

In this article, we have seen that how we can configure Spring boot 2 and Spring Security 5 to secure API with basic authentication.

4. References

5. Source Code

Spring security 5 in-memory Basic Authentication Example (46 KB)




Was this post helpful?
Let us know, if you liked the post. Only in this way, we can improve us.

Leave a Reply

Your email address will not be published. Required fields are marked *