title: Spring Security Basic Auth Password Rotation Issue
body: <p>Experts,,</p>
  <p>I have a spring boot 2.5.5 application(embedded tomcat) where I have to configure the basic auth.</p>
  <p>This is the class I have that does the work for me</p>
  <pre><code>@Component
  @EnableWebSecurity
  public class ApplicationSecurityConfig extends WebSecurityConfigurerAdapter {
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .anyRequest()
                  .authenticated()
                  .and()
                  .httpBasic();
      }
  }
  </code></pre>
  <p>The issue is I just need to enter the user/password once in the browser and it works for any subsequent request. Furthermore, I don't need to supply the new username/password after the server restarts which is driving me crazy - the app still works and I can access my APIs/pages.</p>
  <p>Even if i assume the browser is somehow saving the username and password it should not work once the server is restarted as the password gets changed - isnt it ?</p>
  <p>Update II:</p>
  <p>Following the advice from <em>M. Deinum</em> I made the session stateless and it worked. I then went on to implement Basic Auth with InMemoryUserDetailsManager and added the below code and we are back to the same issue again. The credentials seem to be again stored in session and I need not pass them for the subsequent request.</p>
  <pre><code>@Autowired
      public ApplicationSecurityConfig(PasswordEncoder passwordEncoder) {
          this.passwordEncoder = passwordEncoder;
      }
  
      @Override
      @Bean
      protected UserDetailsService userDetailsService() {
          UserDetails user = User
                  .builder()
                  .username(&quot;admin&quot;)
                  .password(passwordEncoder.encode(&quot;admin&quot;))
                  .roles(&quot;ADMINISTRATOR&quot;)
  
                  .build();
          return new InMemoryUserDetailsManager(user);
      }
  </code></pre>