public class

BasicAuthenticationFilter

extends GenericFilterBean
java.lang.Object
   ↳ org.springframework.web.filter.GenericFilterBean
     ↳ org.springframework.security.web.authentication.www.BasicAuthenticationFilter

Class Overview

Processes a HTTP request's BASIC authorization headers, putting the result into the SecurityContextHolder.

For a detailed background on what this filter is designed to process, refer to RFC 1945, Section 11.1. Any realm name presented in the HTTP request is ignored.

In summary, this filter is responsible for processing any request that has a HTTP request header of Authorization with an authentication scheme of Basic and a Base64-encoded username:password token. For example, to authenticate user "Aladdin" with password "open sesame" the following header would be presented: 


 Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

This filter can be used to provide BASIC authentication services to both remoting protocol clients (such as Hessian and SOAP) as well as standard user agents (such as Internet Explorer and Netscape).

If authentication is successful, the resulting Authentication object will be placed into the SecurityContextHolder.

If authentication fails and ignoreFailure is false (the default), an AuthenticationEntryPoint implementation is called (unless the ignoreFailure property is set to true). Usually this should be BasicAuthenticationEntryPoint, which will prompt the user to authenticate again via BASIC authentication.

Basic authentication is an attractive protocol because it is simple and widely deployed. However, it still transmits a password in clear text and as such is undesirable in many situations. Digest authentication is also provided by Spring Security and should be used instead of Basic authentication wherever possible. See DigestAuthenticationFilter.

Note that if a RememberMeServices is set, this filter will automatically send back remember-me details to the client. Therefore, subsequent requests will not need to present a BASIC authentication header as they will be authenticated using the remember-me mechanism.

Summary

[Expand]
Inherited Fields
From class org.springframework.web.filter.GenericFilterBean
Public Constructors
BasicAuthenticationFilter()
This constructor is deprecated. Use constructor injection
BasicAuthenticationFilter(AuthenticationManager authenticationManager)
Creates an instance which will authenticate against the supplied AuthenticationManager and which will ignore failed authentication attempts, allowing the request to proceed down the filter chain.
BasicAuthenticationFilter(AuthenticationManager authenticationManager, AuthenticationEntryPoint authenticationEntryPoint)
Creates an instance which will authenticate against the supplied AuthenticationManager and use the supplied AuthenticationEntryPoint to handle authentication failures.
Public Methods
void afterPropertiesSet()
void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
void setAuthenticationDetailsSource(AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource)
void setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint)
This method is deprecated. Use constructor injection
void setAuthenticationManager(AuthenticationManager authenticationManager)
This method is deprecated. Use constructor injection
void setCredentialsCharset(String credentialsCharset)
void setIgnoreFailure(boolean ignoreFailure)
This method is deprecated. Use the constructor which takes a single AuthenticationManager parameter
void setRememberMeServices(RememberMeServices rememberMeServices)
Protected Methods
AuthenticationEntryPoint getAuthenticationEntryPoint()
AuthenticationManager getAuthenticationManager()
String getCredentialsCharset(HttpServletRequest httpRequest)
boolean isIgnoreFailure()
void onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult)
void onUnsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed)
[Expand]
Inherited Methods
From class org.springframework.web.filter.GenericFilterBean
From class java.lang.Object
From interface javax.servlet.Filter
From interface org.springframework.beans.factory.BeanNameAware
From interface org.springframework.beans.factory.DisposableBean
From interface org.springframework.beans.factory.InitializingBean
From interface org.springframework.web.context.ServletContextAware

Public Constructors

public BasicAuthenticationFilter ()

This constructor is deprecated.
Use constructor injection

public BasicAuthenticationFilter (AuthenticationManager authenticationManager)

Creates an instance which will authenticate against the supplied AuthenticationManager and which will ignore failed authentication attempts, allowing the request to proceed down the filter chain.

Parameters
authenticationManager the bean to submit authentication requests to

public BasicAuthenticationFilter (AuthenticationManager authenticationManager, AuthenticationEntryPoint authenticationEntryPoint)

Creates an instance which will authenticate against the supplied AuthenticationManager and use the supplied AuthenticationEntryPoint to handle authentication failures.

Parameters
authenticationManager the bean to submit authentication requests to
authenticationEntryPoint will be invoked when authentication fails. Typically an instance of BasicAuthenticationEntryPoint.

Public Methods

public void afterPropertiesSet ()

public void doFilter (ServletRequest req, ServletResponse res, FilterChain chain)

Throws
IOException
ServletException

public void setAuthenticationDetailsSource (AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource)

public void setAuthenticationEntryPoint (AuthenticationEntryPoint authenticationEntryPoint)

This method is deprecated.
Use constructor injection

public void setAuthenticationManager (AuthenticationManager authenticationManager)

This method is deprecated.
Use constructor injection

public void setCredentialsCharset (String credentialsCharset)

public void setIgnoreFailure (boolean ignoreFailure)

This method is deprecated.
Use the constructor which takes a single AuthenticationManager parameter

public void setRememberMeServices (RememberMeServices rememberMeServices)

Protected Methods

protected AuthenticationEntryPoint getAuthenticationEntryPoint ()

protected AuthenticationManager getAuthenticationManager ()

protected String getCredentialsCharset (HttpServletRequest httpRequest)

protected boolean isIgnoreFailure ()

protected void onSuccessfulAuthentication (HttpServletRequest request, HttpServletResponse response, Authentication authResult)

Throws
IOException

protected void onUnsuccessfulAuthentication (HttpServletRequest request, HttpServletResponse response, AuthenticationException failed)

Throws
IOException