Disable Basic Authentication while using Spring Security Java configuration

Question

I am trying to secure a web application using Spring Security java configuration.

This is how the configuration looks:-

@Configuration @EnableWebMvcSecurity public class SecurityConfiguration extends WebSecurityConfigurerAdapter {      private String googleClientSecret;      @Autowired     private CustomUserService customUserService;      /*      * (non-Javadoc)      *       * @see org.springframework.security.config.annotation.web.configuration.      * WebSecurityConfigurerAdapter      * #configure(org.springframework.security.config      * .annotation.web.builders.HttpSecurity)      */     @Override     protected void configure(HttpSecurity http) throws Exception {          // @formatter:off         http             .authorizeRequests()                 .antMatchers(HttpMethod.GET, "/","/static/**", "/resources/**","/resources/public/**").permitAll()                 .anyRequest().authenticated()             .and()                 .formLogin()                     .and()                 .httpBasic().disable()             .requiresChannel().anyRequest().requiresSecure();         // @formatter:on         super.configure(http);     }      @Override     protected void configure(AuthenticationManagerBuilder auth)             throws Exception {         // @formatter:off         auth             .eraseCredentials(true)             .userDetailsService(customUserService);         // @formatter:on         super.configure(auth);     } } 

Notice that I have explicitly disabled HTTP Basic authentication using:-

.httpBasic().disable() 

I am still getting HTTP Authenticaton prompt box while accessing a secured url. Why?

Please help me fix this. I just want to render the default login form that comes bundled.

Spring Boot Starter Version : 1.1.5 Spring Security Version : 3.2.5

Thanks

Answer 1

First of all, calling super.configure(http); will override whole your configuration you have before that.

Try this instead:

http     .authorizeRequests()         .anyRequest().authenticated()         .and()     .formLogin()         .and()     .httpBasic().disable();