Spring Security does not reject requests when missing HTTP basic authentication header

Question

I'm trying to setup a simple HTTP basic authentication mechanism for accessing REST endpoints in an application.

Basically, all endpoints starting with /api/internal shall be secured with HTTP basic authentication, while further configurations shall secure other paths with e.g. OAuth2.

The problem is that, for example, a GET request to /api/internal/test is allowed even when the client does not provide any credentials in the request header.

This is my current security configuration class:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Order(1)
    @Configuration
    @EnableWebSecurity
    public static class InternalApiSecurityConfiguration extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            final PasswordEncoder passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
            auth
                    .inMemoryAuthentication()
                    .passwordEncoder(passwordEncoder)
                    .withUser("user")
                    .password(passwordEncoder.encode("password"))
                    .roles("USER");
        }

        @Override
        protected void configure(HttpSecurity httpSecurity) throws Exception {
            httpSecurity
                    .csrf().disable()
                    .mvcMatcher("/api/internal/**")
                    .authorizeRequests().anyRequest().authenticated()
                    .and()
                    .httpBasic();
        }
    }

    // Other security configuration follow here...
}

Answer 1

After having spent some more time on this problem, I found that the authentication works when adding the following to the chain:

sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)