您尚未启用HTTP基本身份验证，必须使用HttpSecurity.httpBasic()

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter{

    @Autowired
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception{
        auth.inMemoryAuthentication().withUser("user").password("password").roles("admin");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable()
                .httpBasic()
                .and()
                .authorizeRequests()
                    .anyRequest().authenticated();
    }

}

更新

@Override
protected void configure(HttpSecurity http) throws Exception {
  http.csrf().disable().httpBasic().and().authorizeRequests().anyRequest().authenticated();
}