title: Spring Security BASIC auth - matching password hash
body: <p>When doing BASIC authentication with Spring Security I want to match password hash and not password itself. For the sake of storing hash and not the password server-side.</p>
  
  <p>I have the following code:</p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      AppConfig appConfig;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
              http.authorizeRequests()
                      .antMatchers("/v2/**")
                      .hasAuthority(MY_AUTHORITY).anyRequest().authenticated()
                      .and()
                      .httpBasic();
      }
  
      @Autowired
      public void configureSecurityManager(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
              new InMemoryUserDetailsManagerConfigurer&lt;AuthenticationManagerBuilder&gt;()
                      .withUser(appConfig.getCredentials().getUserName())
                      .password(appConfig.getCredentials().getPassword())
                      .authorities(MY_AUTHORITY)
                      .and()
                      .configure(authManagerBuilder);
      }
  }
  </code></pre>
  
  <p>I've found some examples with BCrypt, however they're dealing with hashing the password and not incorporating hash comparison into BASIC auth scheme.</p>
  
  <p>Or am I getting this wrong all the way and client should send hash and not the password to the server?</p>