没有登录表单的 Spring Boot 安全性

Question

I want to add security to a Spring Boot application so I thought about using Spring Security. My only problem is the Login Form, Is there some way to authenticate a User by reading the login credentials from a config file instead of letting someone type in the name and password? I want to do that because the application will be running on a Raspberry Pi. What would be the best approach for something like that?

Answer 1

You can use basic authentication and pass username and password in the header.

The configuration could look like this:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .antMatchers("/api/dashboard/**").permitAll()
            .anyRequest().authenticated()
            .and().httpBasic();

    http.csrf().disable();
}

From the client you have to add the header:

Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l

The string behind Basic is the Base64 encoded username:password