title: Spring Security: IP Address Whitelist Before Deferring to HTTP Basic Auth
body: <p>I have a single URL accessible through a servlet that I have locked down using Spring Security's DaoAuthenticationProvider. I now have the requirement that certain incoming IP addresses must be whitelisted and so are not requested to authenticate.</p>
  
  <p>I can hack around this easily enough by overriding DaoAuthenticationProvider's authenticate method and bypassing the superclasses's implementation if the IP address matches a known IP address but this then only works when the sender of the request supplies a username and password (even if it's nonsense). Otherwise the provider doesn't get called.</p>
  
  <p>What would be the best way to do this? Should I be using a filter to bypass the authentication procedure if a known IP address is incoming?</p>