Claude
e4b5636f7c
Three companion modules verifying and rewriting the Boot 4.1.1 / Framework 7.0.9 story for three older articles: the javax->jakarta.validation namespace fix plus Jakarta Validation 3.1 record-validation clarification, ETag/ conditional-request APIs re-verified unchanged plus the starter rename, and RestTemplate Basic Auth rebuilt on RestClient with the exchange() trap called out. 19 real passing tests generate every transcript quoted from the three companion articles. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EQNA6DJ9VgCtW6zhCE8Xud
2.8 KiB
2.8 KiB
restclient-basic-auth
Companion module for Spring Boot RestTemplate with Basic Auth: A Modern Guide
on ankurm.com, rewritten around RestClient -- Spring Boot 4's recommended synchronous HTTP
client, now that RestTemplate is out of the recommended path. Cross-linked with the deeper
RestTemplate to RestClient Migration Guide.
mvn test starts a real embedded Tomcat with a real Spring Security filter chain on a random port
and makes real HTTP calls against it -- every transcript in docs/output/ is a
genuine request/response pair, not a mocked one.
Versions
| Spring Boot | 4.1.1 |
| Spring Framework | 7.0.9 |
| Spring Security | managed by Boot 4.1.1 |
| JDK | Eclipse Temurin 25.0.4.1 (LTS) |
Quickstart
export JAVA_HOME=/path/to/jdk-25
mvn -DskipTests package
./scripts/run.sh
curl -i -u admin:password123 http://localhost:8080/api/hello
mvn test # 4 tests, regenerates docs/output/
Endpoints and beans
| Shows | |
|---|---|
GET /api/hello (server side) |
Spring Security httpBasic(), unchanged from the original article |
restClientWithDefaultHeaders bean |
RestClient.Builder.defaultHeaders(h -> h.setBasicAuth(...)) |
restClientWithInterceptor bean |
BasicAuthenticationInterceptor, ported unchanged from RestTemplate |
Documentation
- {noop} passwords: still work, still deprecated, no runtime warning
- RestClient with Basic Auth, two ways
- The Boot 4 starter split, and the exchange() trap
Findings worth the trip
{noop}plaintext passwords still work on Boot 4.1 and emit no runtime warning at all -- checked directly by running an app with one and reading the full startup and auth log. The@Deprecatedannotation onNoOpPasswordEncoderis a compile-time signal only.spring-boot-starter-webmvcalone does not include HTTP client auto-configuration.spring-boot-starter-restclientis its own module in Boot 4 and must be declared explicitly, or theRestClient.Builderbean this module depends on is not there.BasicAuthenticationInterceptorneeds zero changes to move fromRestTemplatetoRestClient-- both accept the sameClientHttpRequestInterceptorinterface.RestClient.retrieve()throws on 4xx/5xx by default, same asRestTemplate-- it isRestClient.exchange()specifically that disables that default, a trap covered in depth in the migration guide.
License
MIT -- see LICENSE.