Java / Gradle

6. Security Basic Authentication - Spring Boot vs Micronaut Framework - Building a REST API

This guide compares how to secure a REST API with basic authentication in Micronaut and Spring Boot applications.

Sergio del Amo

On this guide

In this section

Sample Project

You can download a sample application with the code examples in this article.

Introduction

This guide is the sixth tutorial of Building a REST API - a series of tutorials comparing how to develop a REST API with Micronaut Framework and Spring Boot.

In this tutorial, we secure the API via basic authentication. Only users with the role SAAS_SUBSCRIPTION_OWNER can access the endpoints. Each subscription is associated with a user. Authenticated users can only access their own subscriptions.

Dependencies

Spring Boot

In the Spring Boot application, add the Spring Boot Starter Security dependency:

build.gradle

implementation("org.springframework.boot:spring-boot-starter-security")

Micronaut Security

In the Micronaut application, add Micronaut Security and Spring Security Crypto. We use the latter to encrypt the user’s password using BCrypt.

build.gradle

implementation("io.micronaut.security:micronaut-security")
implementation("org.springframework.security:spring-security-crypto:@spring-security-cryptoVersion@")

Entity

We add an owner property to the SaasSubscription entity. The owner is the unique identity of the user who created and can manage a subscription.

Spring Boot

springboot/java/src/main/java/example/micronaut/SaasSubscription.java

package example.micronaut;

import org.springframework.data.annotation.Id;

record SaasSubscription(@Id Long id, String name, Integer cents, String owner) {
}

Micronaut Framework

micronautframework/java/src/main/java/example/micronaut/SaasSubscription.java

package example.micronaut;

import io.micronaut.data.annotation.GeneratedValue;
import io.micronaut.serde.annotation.Serdeable;
import io.micronaut.data.annotation.Id;
import io.micronaut.data.annotation.MappedEntity;

@Serdeable // 
@MappedEntity // 
record SaasSubscription(@Id  // 
                        @GeneratedValue // 
                        Long id,
                        String name,
                        Integer cents,
                        String owner) {
}

1	Declare the `@Serdeable` annotation at the type level in your source code to allow the type to be serialized or deserialized.
2	Annotate the class with `@MappedEntity` to map the class to the table defined in the schema.
3	Specifies the ID of an entity
4	Specifies that the property value is generated by the database and not included in inserts

Repository

We need to modify the repositories to add methods leveraging the owner property.

Spring Boot

springboot/java/src/main/java/example/micronaut/SaasSubscriptionRepository.java

package example.micronaut;

import org.springframework.data.domain.Page;
import org.springframework.data.domain.PageRequest;
import org.springframework.data.repository.CrudRepository;
import org.springframework.data.repository.PagingAndSortingRepository;

interface SaasSubscriptionRepository extends CrudRepository<SaasSubscription, Long>, // 
        PagingAndSortingRepository<SaasSubscription, Long> { // 

    SaasSubscription findByIdAndOwner(Long id, String owner);

    Page<SaasSubscription> findByOwner(String owner, PageRequest pageRequest);
}

1	By extending `CrudRepository` you enable automatic generation of CRUD (Create, Read, Update, Delete) operations.
2	Extend `PagingAndSortingRepository` to support paging and sorting.

Micronaut Framework

micronautframework/java/src/main/java/example/micronaut/SaasSubscriptionRepository.java

package example.micronaut;

import io.micronaut.data.jdbc.annotation.JdbcRepository;
import io.micronaut.data.model.Page;
import io.micronaut.data.model.Pageable;
import io.micronaut.data.model.query.builder.sql.Dialect;
import io.micronaut.data.repository.PageableRepository;

import java.util.Optional;

@JdbcRepository(dialect = Dialect.H2) // 
interface SaasSubscriptionRepository extends PageableRepository<SaasSubscription, Long> { // 

    Optional<SaasSubscription> findByIdAndOwner(Long id, String owner);

    Page<SaasSubscription> findByOwner(String owner, Pageable pageRequest);
}

1	`@JdbcRepository` with a specific dialect.
2	`PageableRepository` extends `CrudRepository`, which provides automatic generation of CRUD (Create, Read, Update, Delete) operations and adds methods for pagination.

Security Configuration

Two sample users will be able to authenticate: sarah1 and john-owns-no-subscriptions. Only the former has the role SAAS_SUBSCRIPTION_OWNER.

Spring Boot

The following class configures Spring Security for the application:

Note

This tutorial disables CSRF only for stateless APIs used by non-browser clients. If a Basic Auth endpoint can be called from a browser, keep CSRF protection enabled or use a credential strategy that browsers do not attach automatically because browsers can send cached Basic Auth credentials on cross-site requests.

springboot/java/src/main/java/example/micronaut/SecurityConfig.java

package example.micronaut;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration // 
class SecurityConfig {

    private static final String ROLE_SAAS_SUBSCRIPTION_OWNER = "SAAS_SUBSCRIPTION_OWNER";
    private static final String ROLE_NON_OWNER = "NON-OWNER";

    @Bean // 
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean // 
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http.authorizeHttpRequests(r -> r.requestMatchers("/subscriptions/**") // 
                        .hasRole(ROLE_SAAS_SUBSCRIPTION_OWNER))
                .httpBasic(Customizer.withDefaults())
                // This sample disables CSRF for the whole app, which is only appropriate
                // for the tutorial's stateless, non-browser client scenario.
                .csrf(AbstractHttpConfigurer::disable)
                .build();
    }

    @Bean // 
    UserDetailsService testOnlyUsers(PasswordEncoder passwordEncoder) {
        User.UserBuilder users = User.builder();
        UserDetails sarah = users
                .username("sarah1")
                .password(passwordEncoder.encode("abc123"))
                .roles(ROLE_SAAS_SUBSCRIPTION_OWNER)
                .build();
        UserDetails hankOwnsNoCards = users
                .username("john-owns-no-subscriptions")
                .password(passwordEncoder.encode("qrs456"))
                .roles(ROLE_NON_OWNER)
                .build();
        return new InMemoryUserDetailsManager(sarah, hankOwnsNoCards); // 
    }
}

1	The `@Configuration` annotation tells Spring to use this class to configure Spring and Spring Boot itself. Any Beans specified in this class are available to Spring’s Auto Configuration engine.
2	Create a bean of type `PasswordEncoder`
3	Create a bean of type `SecurityFilterChain` to configure Spring Security’s filter chain.
4	All HTTP requests to `/subscriptions/**` endpoints require HTTP Basic Authentication. The sample disables CSRF only under the tutorial’s stateless, non-browser-client assumption.
5	Create a bean of type `UserDetails`.
6	`InMemoryUserDetailsManager` is a test-only service that Spring Security provides as a way to provide user authentication and authorization information.

Micronaut Framework

In Micronaut Security, Basic authentication is enabled by default. Micronaut Security attempts to authenticate the supplied credentials against every bean of type AuthenticationProvider. Write the following authentication provider singleton which authenticates the same sample users as we did in the Spring Boot application.

micronautframework/java/src/main/java/example/micronaut/AppAuthenticationProvider.java

package example.micronaut;

import io.micronaut.core.annotation.NonNull;
import io.micronaut.core.annotation.Nullable;
import io.micronaut.http.HttpRequest;
import io.micronaut.security.authentication.Authentication;
import io.micronaut.security.authentication.AuthenticationRequest;
import io.micronaut.security.authentication.AuthenticationResponse;
import io.micronaut.security.authentication.provider.HttpRequestAuthenticationProvider;
import jakarta.inject.Singleton;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

import java.util.Collections;
import java.util.Map;
import java.util.Optional;

@Singleton // 
class AppAuthenticationProvider<B> implements HttpRequestAuthenticationProvider<B> {

    private static final String KEY_PASSWORD = "password";
    private final Map<String, Authentication> users;
    private final PasswordEncoder passwordEncoder;

    AppAuthenticationProvider() {
        passwordEncoder = new BCryptPasswordEncoder();
        users = Map.of("sarah1",
                Authentication.build("sarah1",
                        Collections.singletonList("SAAS_SUBSCRIPTION_OWNER"),
                        Collections.singletonMap(KEY_PASSWORD, passwordEncoder.encode("abc123"))),
                "john-owns-no-subscriptions",
                Authentication.build("john-owns-no-subscriptions",
                        Collections.singletonList("NON-OWNER"),
                        Collections.singletonMap(KEY_PASSWORD, passwordEncoder.encode("qrs456"))));
    }

    @Override
    public @NonNull AuthenticationResponse authenticate(@Nullable HttpRequest<B> request,
                                                        @NonNull AuthenticationRequest<String, String> form) {
        return Optional.ofNullable(users.get(form.getIdentity()))
                .filter(a -> passwordEncoder.matches(form.getSecret(), a.getAttributes().get(KEY_PASSWORD).toString()))
                .map(authentication -> AuthenticationResponse.success(form.getIdentity(), authentication.getRoles()))
                .orElse(AuthenticationResponse.failure());
    }
}

1	Use `jakarta.inject.Singleton` to designate a class as a singleton.

Controllers

Note	Both frameworks allow you to bind the authenticated user to a controller method parameter of type `java.security.Principal`.

The controllers use the methods added to the repositories.

Spring Boot

springboot/java/src/main/java/example/micronaut/SaasSubscriptionController.java

package example.micronaut;

import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.security.Principal;
import java.util.Optional;

@RestController // 
@RequestMapping("/subscriptions") // 
class SaasSubscriptionController {

    private final SaasSubscriptionRepository repository;

    private SaasSubscriptionController(SaasSubscriptionRepository repository) { // 
        this.repository = repository;
    }

    @GetMapping("/{id}") // 
    private ResponseEntity<SaasSubscription> findById(@PathVariable Long id,  // 
                                                      Principal principal) { // 
        return Optional.ofNullable(repository.findByIdAndOwner(id, principal.getName()))
                .map(ResponseEntity::ok)
                .orElseGet(() -> ResponseEntity.notFound().build());
    }
}

1	Annotate a class `@RestController` to identify the class as a `Component` capable of handling HTTP requests.
2	`@RequestMapping` identifies the request paths that invoke this Controller.
3	Use constructor injection to inject a bean of type `SaasSubscriptionRepository`.
4	The `@GetMapping` annotation maps the `findById` method to an HTTP GET request on `/subscriptions/{id}`.
5	Add the `@PathVariable` annotation to the handler method argument to make controller aware.
6	You can bind `java.security.Principal` as a method’s parameter in a controller.

Micronaut Framework

Note	The application endpoints are only accessible to users with role `SAAS_SUBSCRIPTION_OWNER`. The Micronaut application annotates every controller with `@Secured("SAAS_SUBSCRIPTION_OWNER")`. The Spring Boot application specifies the role requirement in the `SecurityConfig.java` file.

micronautframework/java/src/main/java/example/micronaut/SaasSubscriptionController.java

package example.micronaut;

import io.micronaut.http.HttpResponse;
import io.micronaut.http.annotation.Controller;
import io.micronaut.http.annotation.Get;
import io.micronaut.http.annotation.PathVariable;
import java.security.Principal;
import io.micronaut.security.annotation.Secured;

@Controller("/subscriptions") // 
@Secured("SAAS_SUBSCRIPTION_OWNER") // 
class SaasSubscriptionController {

    private final SaasSubscriptionRepository repository;

    SaasSubscriptionController(SaasSubscriptionRepository repository) { // 
        this.repository = repository;
    }

    @Get("/{id}") // 
    HttpResponse<SaasSubscription> findById(@PathVariable Long id, // 
                                            Principal principal) { // 
        return repository.findByIdAndOwner(id, principal.getName())
                .map(HttpResponse::ok)
                .orElseGet(HttpResponse::notFound); // 
    }
}

1	The class is defined as a controller with the @Controller annotation mapped to the path `/subscriptions`.
2	Annotate with `io.micronaut.security.Secured` to configure secured access. You can pass a list of roles which can can access.
3	Use constructor injection to inject a bean of type `SaasSubscriptionRepository`.
4	The @Get annotation maps the `findById` method to an HTTP GET request on `/subscriptions/{id}`.
5	You can define path variables with a RFC-6570 URI template in the HTTP Method annotation value. The method argument can optionally be annotated with `@PathVariable`.
6	You can bind `java.security.Principal` as a method’s parameter in a controller.
7	You can use the HTTPResponse fluid API to control the response’s status code, its body and headers.

Tests

In this tutorial, we use AssertJ in the tests.

Database Schema

The database schema should add owner column.

springboot/java/src/test/resources/schema.sql

CREATE TABLE IF NOT EXISTS saas_subscription
(
    id    BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    name  VARCHAR(255) NOT NULL,
    cents NUMBER NOT NULL DEFAULT 0,
    owner VARCHAR(255) NOT NULL
);

Tests Seed Data

The seed data inserts entries with different owners.

springboot/java/src/test/resources/data.sql

INSERT INTO saas_subscription(id, name, cents, owner) VALUES (99, 'Advanced', 2900, 'sarah1');
INSERT INTO saas_subscription(id, name, cents, owner) VALUES (100, 'Essential', 1400, 'sarah1');
INSERT INTO saas_subscription(id, name, cents, owner) VALUES (101, 'Professional', 4900, 'sarah1');
INSERT INTO saas_subscription(id, name, cents, owner) VALUES (102, 'Enterprise', 9900, 'johnsnow');

Spring Boot Test

The following tests show that you can use the method TestRestTemplate::withBasicAuth to supply basic authentication credentials.

springboot/java/src/test/java/example/micronaut/SecurityTest.java

package example.micronaut;

import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.web.server.LocalServerPort;
import org.springframework.http.HttpStatus;
import org.springframework.test.web.servlet.client.EntityExchangeResult;
import org.springframework.test.web.servlet.client.RestTestClient;

import static org.assertj.core.api.Assertions.assertThat;

@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT) // 
class SecurityTest {

    @LocalServerPort // 
    int port;

    RestTestClient restTestClient; // 

    @BeforeEach
    void setUp() {
        restTestClient = RestTestClient.bindToServer()
                .baseUrl("http://localhost:" + port)
                .build();
    }

    @Test
    void shouldNotAllowAccessToSaasSubscriptionsTheyDoNotOwn() {
        EntityExchangeResult<String> response = withBasicAuth("sarah1", "abc123") // 
                .get()
                .uri("/subscriptions/102") // john's data
                .exchange()
                .returnResult(String.class);
        assertThat(response.getStatus()).isEqualTo(HttpStatus.NOT_FOUND);
    }

    @Test
    void shouldRejectUsersWhoAreNotSubscriptionOwners() {
        EntityExchangeResult<String> response = withBasicAuth("john-owns-no-subscriptions", "qrs456")
                .get()
                .uri("/subscriptions/99")
                .exchange()
                .returnResult(String.class);
        assertThat(response.getStatus()).isEqualTo(HttpStatus.FORBIDDEN);
    }

    @Test
    void shouldNotReturnASaasSubscriptionWithAnUnknownId() {
        EntityExchangeResult<String> response = withBasicAuth("sarah1", "BAD-PASSWORD")
                .get()
                .uri("/subscriptions/1000")
                .exchange()
                .returnResult(String.class);
        assertThat(response.getStatus()).isEqualTo(HttpStatus.UNAUTHORIZED);
        assertThat(response.getResponseBody() == null ? "" : response.getResponseBody()).isBlank();
    }

    private RestTestClient withBasicAuth(String username, String password) {
        return restTestClient.mutate()
                .defaultHeaders(headers -> headers.setBasicAuth(username, password))
                .build();
    }
}

1	The `@SpringBootTest` annotation tells Spring Boot to look for a main configuration class (one with `@SpringBootApplication`, for instance) and use that to start a Spring application context.
2	Inject a bean of type `TestRestTemplate` by using `@Autowired` on the field definition.
3	`TestRestTemplate` is a helper to ease to execution of HTTP requests against the locally running application.
4	basic authentication for `sarah1`.

Micronaut Test

The following tests show that you can use the method MutableHttpRequest::basicAuth to supply basic authentication credentials.

micronautframework/java/src/test/java/example/micronaut/SecurityTest.java

package example.micronaut;

import io.micronaut.http.HttpRequest;
import io.micronaut.http.HttpStatus;
import io.micronaut.http.client.HttpClient;
import io.micronaut.http.client.annotation.Client;
import io.micronaut.http.client.exceptions.HttpClientResponseException;
import io.micronaut.test.extensions.junit5.annotation.MicronautTest;
import io.micronaut.test.annotation.Sql;
import org.junit.jupiter.api.Test;

import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.AssertionsForClassTypes.catchThrowableOfType;

@Sql(value = {"classpath:schema.sql", "classpath:data.sql"})
@MicronautTest // 
class SecurityTest {

    @Test
    void shouldNotAllowAccessToSaasSubscriptionsTheyDoNotOwn(@Client("/") HttpClient httpClient) { // 
        HttpRequest<?> request = HttpRequest.GET("/subscriptions/102")
                .basicAuth("sarah1", "abc123");
        HttpClientResponseException thrown = catchThrowableOfType(() ->
                httpClient.toBlocking().exchange(request, String.class), HttpClientResponseException.class);  // 
        assertThat(thrown.getStatus().getCode()).isEqualTo(HttpStatus.NOT_FOUND.getCode());
    }

    @Test
    void shouldRejectUsersWhoAreNotSubscriptionOwners(@Client("/") HttpClient httpClient) { // 
        HttpRequest<?> badPasswordRequest = HttpRequest.GET("/subscriptions/99")
                .basicAuth("john-owns-no-subscriptions", "qrs456");
        HttpClientResponseException badPasswordEx = catchThrowableOfType(() ->
                httpClient.toBlocking().exchange(badPasswordRequest, String.class), HttpClientResponseException.class);  // 
        assertThat(badPasswordEx.getStatus().getCode()).isEqualTo(HttpStatus.FORBIDDEN.getCode());
    }

    @Test
    void shouldNotReturnASaasSubscriptionWithAnUnknownId(@Client("/") HttpClient httpClient) { // 
        HttpRequest<?> request = HttpRequest.GET("/subscriptions/1000")
                .basicAuth("sarah1", "BAD-PASSWORD");
        HttpClientResponseException ex = catchThrowableOfType(() ->
                httpClient.toBlocking().exchange(request, String.class), HttpClientResponseException.class);  // 
        assertThat(ex.getStatus().getCode()).isEqualTo(HttpStatus.UNAUTHORIZED.getCode());
    }
}

1	Annotate the class with `@MicronautTest` so the Micronaut framework will initialize the application context and the embedded server. More info.
2	Inject the `HttpClient` bean and point it to the embedded server.
3	When the HTTP Client receives a response with an HTTP Status Code >= 400, it throws an `HttpClientResponseException`. You can obtain the response status and body from the exception.

Conclusion

As you see in this tutorial, securing a REST API with basic authentication is straightforward in both Micronaut and Spring Boot. Security configuration differs between the frameworks, but the coding experience of accessing the authenticated user as a controller method parameter of type java.security.Principal is identical.

Next Steps

Learn more about Micronaut Security

License

Note	All guides are released with an Apache License 2.0 for the code and a Creative Commons Attribution 4.0 license for the writing and media (images).