Securing REST APIs with HTTP BASIC authentication
By: Somnath Musib
Tags: Security, Spring Boot, Programming, Development, Technology

Securing REST APIs with HTTP BASIC authentication

Security is no longer an afterthought, it's a must in any application these days.

In the modern era, security is an essential feature in any application, your REST services are no exception to it. In this short tutorial, we’ll discuss how to secure your REST APIs with BASIC authentication. We’ll use Spring Security to implement the security of the API

Application Endpoints

We’ll use a fictitious application that lets us manage our favorite web URLs. Let us call this application Pocket. It has the following endpoints:

GET /pockets: Returns all available pockets

GET /pockets/{id}: Returns the available pocket for the supplied id. Return an error for invalid ids

POST /pockets: Create a new pocket

PUT /pockets: Update an existing pocket

DELETE /pockets/{id}: Delete a pocket by the supplied id

Application Development

Let us now generate a Spring Boot project with the web, lombok, data-jpa, and H2 dependencies.

Let us now the Pocket model object:

Pocket Model POJO

Let us now create the PocketRespository that lets us manage the pockets in the H2 database:

Now that the repository is ready, let us create the PocketController class that provides the HTTP endpoints:

We’ve used a custom exception that is thrown if there is an invalid pocket id is supplied:

At this point, the API is ready to manage the pockets. However, the application is not at all secure and all pocket endpoints are accessible to everyone. Let us add the security aspect to the application. To begin with, let us first add the spring-boot-starter-security dependency in the pom.xml. This dependency brings-in the Spring Security infrastructure to the application. We now want to implement the HTTP Basic authentication.

This Security configuration class lets you customize the security settings of your application. Let us explain the changes:

You have extended the WebSecurityConfigurerAdapter class that lets you customize the Spring Security default configuration You have overridden the configure method and ensured that all request to the application needs to be authenticated and the authentication mode is HTTP BASIC You have provided a Bean definition for UserDetailsService. This interface is used to configure application users. We’ve used the in-memory one and hardcoded two user details Lastly, you have provided a Bean definition for PasswordEncoder. A PasswordEncoder is used to encode the plain-text password to a scrambled text to protect it from unauthorized access. For testing purposes, we’ve provided the NoOpsPasswordEncoder which does not provide any encoding at all. In a secure application, we should use better PasswordEncoders such as BCrypt

We’ve created a few sample pockets in the main class:

Testing the Application

If you access the endpoints without BASIC authentication, you’ll be returned an HTTP 401 status code indicating you are Unauthorized:

If you provide the BASIC authentication details, you can access the endpoints:

Source Code

The source code for this article is available in the GitHub repository at https://github.com/musibs/medium-articles/tree/master/spring-rest-basic-auth