Claude
e4b5636f7c
Three companion modules verifying and rewriting the Boot 4.1.1 / Framework 7.0.9 story for three older articles: the javax->jakarta.validation namespace fix plus Jakarta Validation 3.1 record-validation clarification, ETag/ conditional-request APIs re-verified unchanged plus the starter rename, and RestTemplate Basic Auth rebuilt on RestClient with the exchange() trap called out. 19 real passing tests generate every transcript quoted from the three companion articles. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EQNA6DJ9VgCtW6zhCE8Xud
62 lines
2.8 KiB
Markdown
62 lines
2.8 KiB
Markdown
# restclient-basic-auth
|
|
|
|
Companion module for [**Spring Boot RestTemplate with Basic Auth: A Modern Guide**](https://ankurm.com/spring-boot-resttemplate-with-basic-auth-a-modern-guide/)
|
|
on ankurm.com, rewritten around **RestClient** -- Spring Boot 4's recommended synchronous HTTP
|
|
client, now that `RestTemplate` is out of the recommended path. Cross-linked with the deeper
|
|
[RestTemplate to RestClient Migration Guide](https://ankurm.com/resttemplate-to-restclient-migration-guide/).
|
|
|
|
`mvn test` starts a real embedded Tomcat with a real Spring Security filter chain on a random port
|
|
and makes real HTTP calls against it -- every transcript in [`docs/output/`](docs/output) is a
|
|
genuine request/response pair, not a mocked one.
|
|
|
|
## Versions
|
|
|
|
| | |
|
|
|---|---|
|
|
| Spring Boot | 4.1.1 |
|
|
| Spring Framework | 7.0.9 |
|
|
| Spring Security | managed by Boot 4.1.1 |
|
|
| JDK | Eclipse Temurin 25.0.4.1 (LTS) |
|
|
|
|
## Quickstart
|
|
|
|
```bash
|
|
export JAVA_HOME=/path/to/jdk-25
|
|
mvn -DskipTests package
|
|
./scripts/run.sh
|
|
curl -i -u admin:password123 http://localhost:8080/api/hello
|
|
mvn test # 4 tests, regenerates docs/output/
|
|
```
|
|
|
|
## Endpoints and beans
|
|
|
|
| | Shows |
|
|
|---|---|
|
|
| `GET /api/hello` (server side) | Spring Security `httpBasic()`, unchanged from the original article |
|
|
| `restClientWithDefaultHeaders` bean | `RestClient.Builder.defaultHeaders(h -> h.setBasicAuth(...))` |
|
|
| `restClientWithInterceptor` bean | `BasicAuthenticationInterceptor`, ported unchanged from RestTemplate |
|
|
|
|
## Documentation
|
|
|
|
1. [{noop} passwords: still work, still deprecated, no runtime warning](docs/01-password-encoding.md)
|
|
2. [RestClient with Basic Auth, two ways](docs/02-restclient-basic-auth-patterns.md)
|
|
3. [The Boot 4 starter split, and the exchange() trap](docs/03-starter-split-and-exchange-trap.md)
|
|
|
|
## Findings worth the trip
|
|
|
|
- **`{noop}` plaintext passwords still work on Boot 4.1 and emit no runtime warning at all** --
|
|
checked directly by running an app with one and reading the full startup and auth log. The
|
|
`@Deprecated` annotation on `NoOpPasswordEncoder` is a compile-time signal only.
|
|
- **`spring-boot-starter-webmvc` alone does not include HTTP client auto-configuration.**
|
|
`spring-boot-starter-restclient` is its own module in Boot 4 and must be declared explicitly, or
|
|
the `RestClient.Builder` bean this module depends on is not there.
|
|
- **`BasicAuthenticationInterceptor` needs zero changes to move from `RestTemplate` to
|
|
`RestClient`** -- both accept the same `ClientHttpRequestInterceptor` interface.
|
|
- **`RestClient.retrieve()` throws on 4xx/5xx by default, same as `RestTemplate`** -- it is
|
|
`RestClient.exchange()` specifically that disables that default, a trap covered in depth in the
|
|
[migration guide](https://ankurm.com/resttemplate-to-restclient-migration-guide/).
|
|
|
|
## License
|
|
|
|
MIT -- see [LICENSE](../LICENSE).
|