title: Spring Security Basic Authentication only happens once
body: <p>Recently I am using Spring Security basic authentication for my REST services.</p>
  
  <p>Below is the security xml configuration:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:security="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
         http://www.springframework.org/schema/beans/spring-beans.xsd
         http://www.springframework.org/schema/security
         http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
      &lt;security:http pattern="/rest/**" create-session="never" use-expressions="true"&gt;
          &lt;security:http-basic /&gt;
          &lt;security:intercept-url pattern="/rest/auth/**" access="isAuthenticated()"/&gt;
      &lt;/security:http&gt;
  
      &lt;security:authentication-manager alias="authenticationManager"&gt;
          &lt;security:authentication-provider&gt;
              &lt;security:user-service&gt;
                  &lt;security:user name="admin" password="admin" authorities="ROLE_ADMIN"/&gt;
              &lt;/security:user-service&gt;
          &lt;/security:authentication-provider&gt;
          &lt;security:authentication-provider user-service-ref="userDetailsService"&gt;
              &lt;security:password-encoder hash="sha-256" /&gt;
          &lt;/security:authentication-provider&gt;
      &lt;/security:authentication-manager&gt;
  
      &lt;security:global-method-security jsr250-annotations="enabled" pre-post-annotations="enabled"/&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>Spring framework and Spring Security that I use:</p>
  
  <pre><code>&lt;springframework.version&gt;4.1.0.RELEASE&lt;/springframework.version&gt;
  &lt;spring.security.version&gt;3.2.5.RELEASE&lt;/spring.security.version&gt;
  </code></pre>
  
  <p>I map my REST services to URL prefixed with "rest/" and when I access the URL for the first time, the browser prompt the username and password field of basic authentication. I fill it with the right credential and my controller accessed successfully.</p>
  
  <p>However if I try to access the same URL with browser again, it will not prompt me the username and password field of basic authentication again and directly access the URL.</p>
  
  <p>I expect that browser always prompt me with basic authentication because I set create-session attribute to never.</p>
  
  <p>So, am I missing something? </p>