Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

Basic authentication

Red Hat build of Quarkus 3.20

Guide

초록

This guide introduces HTTP Basic authentication as a minimal-resource technique for securing Quarkus application endpoints. It details the use of the Authorization header for transmitting Base64-encoded credentials and highlights the need for HTTPS to protect these credentials during transmission. It discusses limitations such as lack of encryption for credentials, the need to send credentials with each request, and the increased complexity of managing credentials within the application. Implementation guidance and references to additional security resources, including enabling Basic authentication and role-based access control (RBAC), are also provided.

Providing feedback on Red Hat build of Quarkus documentation
링크 복사

To report an error or to improve our documentation, log in to your Red Hat Jira account and submit an issue. If you do not have a Red Hat Jira account, then you will be prompted to create an account.

Procedure

  1. Click the following link to create a ticket.
  2. Enter a brief description of the issue in the Summary.
  3. Provide a detailed description of the issue or enhancement in the Description. Include a URL to where the issue occurs in the documentation.
  4. Clicking Submit creates and routes the issue to the appropriate documentation team.

1장. Basic authentication
링크 복사

HTTP Basic authentication is one of the least resource-demanding techniques that enforce access controls to web resources. You can secure your Quarkus application endpoints by using HTTP Basic authentication. Quarkus includes a built-in authentication mechanism for Basic authentication.

Basic authentication uses fields in the HTTP header and does not rely on HTTP cookies, session identifiers, or login pages.

1.1. Authorization header
링크 복사

An HTTP user agent, like a web browser, uses an Authorization header to provide a username and password in each HTTP request. The header is specified as Authorization: Basic <credentials>, where credentials are the Base64 encoding of the user ID and password, joined by a colon.

Example:

If the user name is Alice and the password is secret, the HTTP authorization header would be Authorization: Basic QWxjZTpzZWNyZXQ=, where QWxjZTpzZWNyZXQ= is a Base64 encoded representation of the Alice:secret string.

The Basic authentication mechanism does not provide confidentiality protection for the transmitted credentials. The credentials are merely encoded with Base64 when in transit, and not encrypted or hashed in any way. Therefore, to provide confidentiality, use Basic authentication with HTTPS.

Basic authentication is a well-specified, simple challenge and response scheme that all web browsers and most web servers understand.

1.2. Limitations with using Basic authentication
링크 복사

The following table outlines some limitations of using HTTP Basic authentication to secure your Quarkus applications:

Expand
표 1.1. Limitations of HTTP Basic authentication
LimitationDescription

Credentials are sent as plain text

Use HTTPS with Basic authentication to avoid exposing the credentials. The risk of exposing credentials as plain text increases if a load balancer terminates HTTPS because the request is forwarded to Quarkus over HTTP. Furthermore, in multi-hop deployments, the credentials can be exposed if HTTPS is used between the client and the first Quarkus endpoint only, and the credentials are propagated to the next Quarkus endpoint over HTTP.

Credentials are sent with each request

In Basic authentication, a username and password must be sent with each request, increasing the risk of exposing credentials.

Application complexity increases

The Quarkus application must validate that usernames, passwords, and roles are managed securely. This process, however, can introduce significant complexity to the application. Depending on the use case, other authentication mechanisms that delegate username, password, and role management to specialized services might be more secure.

1.3. Implementing Basic authentication in Quarkus
링크 복사

For more information about how you can secure your Quarkus applications by using Basic authentication, see the following resources:

1.4. Role-based access control
링크 복사

Red Hat build of Quarkus also includes built-in security to allow for role-based access control (RBAC) based on the common security annotations @RolesAllowed, @DenyAll, @PermitAll on REST endpoints and CDI beans. For more information, see the Quarkus Authorization of web endpoints guide.

1.5. References
링크 복사

2장. Enable Basic authentication
링크 복사

Enable Basic authentication for your Quarkus project and allow users to authenticate with a username and password.

2.1. Prerequisites
링크 복사

The following procedure outlines how you can enable Basic authentication for your application by using the elytron-security-properties-file extension.

2.2. Procedure
링크 복사

  1. In the application.properties file, set the quarkus.http.auth.basic property to true. 

    quarkus.http.auth.basic=true

  2. Optional: In a non-production environment only and purely for testing Quarkus Security in your applications:

    1. To enable authentication for the embedded realm, set the quarkus.security.users.embedded.enabled property to true. 

      quarkus.security.users.embedded.enabled=true

    2. You can also configure the required user credentials, user name, secret, and roles. For example: 

      quarkus.http.auth.basic=true
quarkus.security.users.embedded.enabled=true
quarkus.security.users.embedded.plain-text=true
quarkus.security.users.embedded.users.alice=alice
      1 
      
quarkus.security.users.embedded.users.bob=bob
      2 
      
quarkus.security.users.embedded.roles.alice=admin
      3 
      
quarkus.security.users.embedded.roles.bob=user
      4
      1 3
      The user, alice, has alice as their password and admin as their role.
      2 4
      The user, bob, has bob as their password and user as their role.

      For information about other methods that you can use to configure the required user credentials, see the Configuring User Information section of the Quarkus "Security Testing" guide.

      중요

      Configuring user names, secrets, and roles in the application.properties file is appropriate only for testing scenarios. For securing a production application, it is crucial to use a database to store this information.

2.3. Next steps
링크 복사

For a more detailed walk-through that shows you how to configure Basic authentication together with Jakarta Persistence for storing user credentials in a database, see the Getting started with Security by using Basic authentication and Jakarta Persistence guide.

2.4. References
링크 복사

Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

Legal Notice

Theme

© 2026 Red Hat맨 위로 이동