SpringBoot Security - Part4 (Basic Authentication)
Monday, 24 March 2025 12:01 PM
Basic Authentication
• It’s a Stateless Authentication method.
○ Stateless authentication means, server do not maintains the user authentication state (aka
Session ).
• In this, client has to pass the username and password with every request using Authorization
header
Authorization: Basic <base64(username:password)>
• These Credentials are encoded using Base64 (not encrypted), making it insecure over HTTP.
Let's go step by step:
1st: Lets create a user
• Already discussed, all possible ways to create user and how we can create users dynamically and with
industry standard approach.
• Also how to create and store it in DB or in-memory. So kindly check that out if there is any doubt with user
creation process.
Lets create a user for testing purpose:
[Link]
[Link]
Reads Authorization Header
Decode the encoded
username and password
After decoding, we can see
What username and password
Client passed
One question comes to mind is, why we need to send username and password in Authorization
header, what not in Request body or any other way?
Possible reasons:
1. Standard:
As per HTTP Standardization (RFC 7617), this format is accepted, in order to make it universally
accepted standard across APIs and Clients.
Otherwise, if there is no Standard follows and some send in Headers, some in body etc, then its
difficult when need to deal with multiple APIs and Clients.
2. Security:
Web servers sometimes log the request body for debugging or analytics purpose.
But Headers are typically not logged. So this reduce the risk of exposures of client username and
password.
3. Support for all HTTP request:
Apart from POST & PUT, there are HTTP requests like GET which do not accept any Request
body. So with Headers for such APIs too, credentials can be sent consistently.
Now, lets understand the flow of Basic Authentication:
• If Form Based Authentication flow is understood properly, then this flow is very similar to
that.
Security
Filter Chain
This is how Authentication object looks like, currently
Authenticated is false
Security Filter Chain
2. Create and Pass the
3. Delegates
4. Incoming raw password
"Authentication" Authentication is hashed PasswordEncoder
BasicAuthenticationFilter Object to to
AuthenticationManager
AuthenticationProvider
1. Decode the Authorization
<<Interface>
Header
8. Return back 7. Updated >
5. Fetch
9. Save the UserDetailsService
"Authentication" UserDetails
Authentication Object in fully "Authentication" Object Like username,
SecurityContext object
SecurityContextHolder password, Roles Either from
Default Implementation etc.
SecurityContext
Authentication object is InMemoryUserDetailsManage
stored in this Context
DaoAuthenticationProvider r
ProviderManager (handles username/Password)
(manage username/password in Memory)
or
6. Validate Incoming Username and
hashed password with Stored username
and hashed password. JdbcUserDetailsManager
DB
(manage username/password in DB)
AuthorizationFilter
This is how Authentication object looks like after
successful authentication , Authenticated status
changed to true.
So, what we need to implement it?
[Link]
[Link]
Added for
authorization
Its a stateless method
Since its stateless, CSRF is not required
Basic authentication method to be used
Disadvantages of Basic
Authentication:
1. Credentials sent in every request, if HTTPS is not enforced, then it can be
intercepted and then decoded.
2. If Credentials are compromised, then only way is to change the credentials.
3. Not suitable for large scale application, as sending credentials with every request
is an extra overhead.
i. As request size increases because of authorization header.
ii. Extra work like decoding, hashing of incoming password, fetching username and
password from DB, comparing etc..
iii. DB lookup to fetch user details which increase latency too.