title: How to send Authorization header with browser
body: <p>I have implemented a web server which uses Basic authentication(using spring security).  </p>
  
  <p>I disabled the default authentication entry point when accessing a URL (instead of responding 401 with www-authentication header, it just returns 401), the purpose is to prevent the browser from displaying the authentication popup.  </p>
  
  <p>I am able to connect to the server with javascript code and command line tools like curl, however when I tested it with browsers (chrome &amp; firefox), they just don't send the header.  </p>
  
  <p><code>curl -v -u user:password localhost:8080/user</code>  </p>
  
  <blockquote>
    <p>GET /user HTTP/1.1<br>
    Host: localhost:8080<br>
    <strong>Authorization: Basic dXNlcjpwYXNzd29yZA==</strong><br>
    User-Agent: curl/7.58.0<br>
    Accept: <em>/</em>  </p>
  </blockquote>
  
  <p>Chrome: version 71.0.3578.98 (Official Build) (64-bit)<br>
  <a href="http://user:password@localhost:8080/user" rel="noreferrer">http://user:password@localhost:8080/user</a></p>
  
  <blockquote>
    <p>GET /user HTTP/1.1<br>
    Host: localhost:8080<br>
    Connection: keep-alive<br>
    Upgrade-Insecure-Requests: 1<br>
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36<br>
    DNT: 1<br>
    Accept:<br>
    text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,<em>/</em>;q=0.8<br>
    Accept-Encoding: gzip, deflate, br
    Accept-Language: en-AU,en;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-GB;q=0.6,en-US;q=0.5  </p>
  </blockquote>
  
  <p>Why the browsers are not sending the authentication header.</p>