The idea is to get the HTTP API Key header from the request and then check the secret with our configuration . In this case, we need to add a custom Filter in the Spring Security configuration class .

We'll start by implementing the GenericFilterBean . The GenericFilterBean is a simple javax.servlet.Filter implementation that is Spring-aware.

Let's create the AuthenticationFilter class:

public class AuthenticationFilter extends GenericFilterBean {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
      throws IOException, ServletException {
        try {
            Authentication authentication = AuthenticationService.getAuthentication((HttpServletRequest) request);
            SecurityContextHolder.getContext().setAuthentication(authentication);
        } catch (Exception exp) {
            HttpServletResponse httpResponse = (HttpServletResponse) response;
            httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            httpResponse.setContentType(MediaType.APPLICATION_JSON_VALUE);
            PrintWriter writer = httpResponse.getWriter();
            writer.print(exp.getMessage());
            writer.flush();
            writer.close();
        filterChain.doFilter(request, response);
We only need to implement a doFilter() method. In this method, we evaluate the API Key header and set the resulting Authentication object into the current SecurityContext instance.
Then, the request is passed to the remaining filters for processing and then routed to DispatcherServlet and finally to our controller.

We delegate the evaluation of the API Key and constructing the Authentication object to the AuthenticationService class:
public class AuthenticationService {
    private static final String AUTH_TOKEN_HEADER_NAME = "X-API-KEY";
    private static final String AUTH_TOKEN = "Baeldung";
    public static Authentication getAuthentication(HttpServletRequest request) {
        String apiKey = request.getHeader(AUTH_TOKEN_HEADER_NAME);
        if (apiKey == null || !apiKey.equals(AUTH_TOKEN)) {
            throw new BadCredentialsException("Invalid API Key");
        return new ApiKeyAuthentication(apiKey, AuthorityUtils.NO_AUTHORITIES);
Here, we check whether the request contains the API Key header with a secret or not. If the header is null or isn't equal to secret, we throw a BadCredentialsException. If the request has the header, it performs the authentication, adds the secret to the security context, and then passes the call to the next security filter. Our getAuthentication method is quite simple – we just compare the API Key header and secret with a static value.
To construct the Authentication object, we must use the same approach Spring Security typically uses to build the object on a standard authentication. So, let's extend the AbstractAuthenticationToken class and manually trigger authentication.
3.3. Extending AbstractAuthenticationToken

To successfully implement authentication for our application, we need to convert the incoming API Key to an Authentication object such as an AbstractAuthenticationToken. The AbstractAuthenticationToken class implements the Authentication interface, representing the secret/principal for an authenticated request.
Let's create the ApiKeyAuthentication class: 
public class ApiKeyAuthentication extends AbstractAuthenticationToken {
    private final String apiKey;
    public ApiKeyAuthentication(String apiKey, Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.apiKey = apiKey;
        setAuthenticated(true);
    @Override
    public Object getCredentials() {
        return null;
    @Override
    public Object getPrincipal() {
        return apiKey;
The ApiKeyAuthentication class is a type of AbstractAuthenticationToken object with the apiKey information obtained from the HTTP request. We use the setAuthenticated(true) method in the construction. As a result, the Authentication object contains apiKey and authenticated fields:
3.4. Security Config

We can register our custom filter programmatically by creating a SecurityFilterChain bean. In this case, we need to add the AuthenticationFilter before the UsernamePasswordAuthenticationFilter class using the addFilterBefore() method on an HttpSecurity instance.
Let's create the SecurityConfig class:

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf()
          .disable()
          .authorizeRequests()
          .antMatchers("/**")
          .authenticated()
          .and()
          .httpBasic()
          .and()
          .sessionManagement()
          .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
          .and()
          .addFilterBefore(new AuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
        return http.build();
Also, the session policy is set to STATELESS because we'll use REST endpoints.
3.5. ResourceController

Last, we'll create the ResourceController with a /home mapping:  
@RestController
public class ResourceController {
    @GetMapping("/home")
    public String homeEndpoint() {
        return "Baeldung !";
3.6. Disabling the Default Auto-Configuration

We need to discard the security auto-configuration. To do this, we exclude the SecurityAutoConfiguration and UserDetailsServiceAutoConfiguration classes:
@SpringBootApplication(exclude = {SecurityAutoConfiguration.class, UserDetailsServiceAutoConfiguration.class})
public class ApiKeySecretAuthApplication {
    public static void main(String[] args) {
        SpringApplication.run(ApiKeySecretAuthApplication.class, args);
 Now, the application is ready to test.
4. Testing

We can use the curl command to consume the secured application.
First, let's try to request the /home without providing any security credentials:
curl --location --request GET 'http://localhost:8080/home'
We get back the expected 401 Unauthorized.
Now let's request the same resource, but provide the API Key and secret to access it as well:

curl --location --request GET 'http://localhost:8080/home' \
--header 'X-API-KEY: Baeldung'
As a result, the response from the server is 200 OK.
5. Conclusion

In this tutorial, we discussed the REST API security mechanisms. Then, we implemented Spring Security in our Spring Boot application to secure our REST API using the API Keys authentication mechanism.
As always, code samples can be found over on GitHub.
Partner – AEGIK AB – NPI EA (tag = SQL)


Slow MySQL query performance is all too common. Of course
it is. A good way to go is, naturally, a dedicated profiler that
actually understands the ins and outs of MySQL.
The Jet Profiler was built for MySQL only, so it can do
things like real-time query performance, focus on most used tables
or most frequent queries, quickly identify performance issues and
basically help you optimize your queries.
Critically, it has very minimal impact on your server's
performance, with most of the profiling work done separately - so
it needs no server changes, agents or separate services.
Basically, you install the desktop application, connect to your MySQL
server, hit the record button, and you'll have results
within minutes:
out the Profiler

Course – LSS (cat=Security/Spring Security)

I just announced the new Learn Spring Security course, including the full material focused on the new OAuth2 stack in Spring Security 5:
>> CHECK OUT THE COURSE
res – Security (video) (cat=Security/Spring Security)

Learn the basics of securing a REST API with Spring
Get access to the video lesson