title: Spring session login
body: <p>I would like to build a web application based on <a href="https://github.com/spring-guides/tut-spring-security-and-angular-js/tree/master/spring-session" rel="nofollow noreferrer">this example</a>.   </p>
  
  <p>What I understood from this example is that you build 2 applications:<br>
  A UI application containing the web pages where you can login to get a token and a resource application where you ask for data using your token.</p>
  
  <p>My question is where is the login check done?<br>
  The <strong>application.yml</strong> file defines the password "<strong>password</strong>" for the user "<strong>user</strong>"</p>
  
  <pre><code>security:
    user:
      password: password
  </code></pre>
  
  <p>But this file is never mentioned neither in <strong>UIApplication.java</strong> file or in any other file:</p>
  
  <pre><code>@SpringBootApplication
  @RestController
  public class UiApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(UiApplication.class, args);
      }
  
      @Configuration
      @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
      protected static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              // @formatter:off
              http
                  .httpBasic().and()
                  .logout().and()
                  .authorizeRequests()
                      .antMatchers("/index.html", "/pages/home.html", "/pages/login.html", "/").permitAll()
                      .anyRequest().authenticated().and()
                  .csrf()
                      .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
              // @formatter:on
          }
      }
  
      @RequestMapping("/user")
      public Principal user(Principal user) {
          return user;
      }
  
      @RequestMapping("/token")
      public Map&lt;String,String&gt; token(HttpSession session) {
          return Collections.singletonMap("token", session.getId());
      }
  
  }
  </code></pre>
  
  <p>However it works: when I login using "user" and "password" login succeeds, when I use different credentials, it fails.<br>
  Is it some high level Spring layer dealing with that? Thanks for help.</p>