# restclient-basic-auth

Companion module for [**Spring Boot RestTemplate with Basic Auth: A Modern Guide**](https://ankurm.com/spring-boot-resttemplate-with-basic-auth-a-modern-guide/)
on ankurm.com, rewritten around **RestClient** -- Spring Boot 4's recommended synchronous HTTP
client, now that `RestTemplate` is out of the recommended path. Cross-linked with the deeper
[RestTemplate to RestClient Migration Guide](https://ankurm.com/resttemplate-to-restclient-migration-guide/).

`mvn test` starts a real embedded Tomcat with a real Spring Security filter chain on a random port
and makes real HTTP calls against it -- every transcript in [`docs/output/`](docs/output) is a
genuine request/response pair, not a mocked one.

## Versions

| | |
|---|---|
| Spring Boot | 4.1.1 |
| Spring Framework | 7.0.9 |
| Spring Security | managed by Boot 4.1.1 |
| JDK | Eclipse Temurin 25.0.4.1 (LTS) |

## Quickstart

```bash
export JAVA_HOME=/path/to/jdk-25
mvn -DskipTests package
./scripts/run.sh
curl -i -u admin:password123 http://localhost:8080/api/hello
mvn test               # 4 tests, regenerates docs/output/
```

## Endpoints and beans

| | Shows |
|---|---|
| `GET /api/hello` (server side) | Spring Security `httpBasic()`, unchanged from the original article |
| `restClientWithDefaultHeaders` bean | `RestClient.Builder.defaultHeaders(h -> h.setBasicAuth(...))` |
| `restClientWithInterceptor` bean | `BasicAuthenticationInterceptor`, ported unchanged from RestTemplate |

## Documentation

1. [{noop} passwords: still work, still deprecated, no runtime warning](docs/01-password-encoding.md)
2. [RestClient with Basic Auth, two ways](docs/02-restclient-basic-auth-patterns.md)
3. [The Boot 4 starter split, and the exchange() trap](docs/03-starter-split-and-exchange-trap.md)

## Findings worth the trip

- **`{noop}` plaintext passwords still work on Boot 4.1 and emit no runtime warning at all** --
  checked directly by running an app with one and reading the full startup and auth log. The
  `@Deprecated` annotation on `NoOpPasswordEncoder` is a compile-time signal only.
- **`spring-boot-starter-webmvc` alone does not include HTTP client auto-configuration.**
  `spring-boot-starter-restclient` is its own module in Boot 4 and must be declared explicitly, or
  the `RestClient.Builder` bean this module depends on is not there.
- **`BasicAuthenticationInterceptor` needs zero changes to move from `RestTemplate` to
  `RestClient`** -- both accept the same `ClientHttpRequestInterceptor` interface.
- **`RestClient.retrieve()` throws on 4xx/5xx by default, same as `RestTemplate`** -- it is
  `RestClient.exchange()` specifically that disables that default, a trap covered in depth in the
  [migration guide](https://ankurm.com/resttemplate-to-restclient-migration-guide/).

## License

MIT -- see [LICENSE](../LICENSE).