Implementing Basic Authentication in Java REST APIs

How does Basic Authentication work in Rest API in Java project?

Basic Authentication is a simple authentication scheme built into the HTTP protocol. It is commonly used in REST APIs to secure endpoints by requiring clients to provide a username and password. Here's how it works and how you can implement it in a Java project.

How Basic Authentication Works

1. Client Request: When a client wants to access a protected resource, it sends an HTTP request to the server. If the resource requires authentication, the server responds with a 401 Unauthorized status code and a WWW-Authenticate header indicating that Basic Authentication is required.

2. Client Response: The client then resends the request, this time including an Authorization header. The header contains the word "Basic" followed by a space and a base64-encoded string of the format username:password.

   Example:

   Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
   

   Here, dXNlcm5hbWU6cGFzc3dvcmQ= is the base64 encoding of username:password.

3. Server Validation: The server decodes the base64 string, extracts the username and password, and checks them against its user database. If the credentials are valid, the server processes the request and returns the requested resource. If not, it responds with a 401 Unauthorized status.

Implementing Basic Authentication in a Java REST API

You can implement Basic Authentication in a Java REST API using various frameworks. Below is an example using Spring Boot.

Step 1: Add Dependencies

Make sure you have the necessary dependencies in your pom.xml if you are using Maven:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Step 2: Configure Security

Create a security configuration class to set up Basic Authentication:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .anyRequest().authenticated() // Require authentication for all requests
                .and()
            .httpBasic(); // Enable Basic Authentication
    }
}

Step 3: User Details Service

You can create a simple in-memory user store for demonstration purposes:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("user").password(passwordEncoder().encode("password")).roles("USER")
            .and()
            .withUser("admin").password(passwordEncoder().encode("admin")).roles("ADMIN");
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .httpBasic();
    }
}

Step 4: Create a REST Controller

Now, create a simple REST controller to test the authentication:

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class HelloController {

    @GetMapping("/hello")
    public String hello() {
        return "Hello, authenticated user!";
    }
}

Step 5: Run the Application

Run your Spring Boot application. You can test the Basic Authentication using tools like Postman or curl.

Example using curl:

curl -u user:password http://localhost:8080/hello

If the credentials are correct, you should receive a response:

Hello, authenticated user!

If the credentials are incorrect, you will receive a 401 Unauthorized response.

Conclusion

Basic Authentication is a straightforward way to secure REST APIs, but it has limitations, such as sending credentials in every request and being vulnerable to man-in-the-middle attacks if not used over HTTPS. For production applications, consider using more secure authentication methods like OAuth2 or JWT.