java - Spring Security anonymous 401 instead of 403 -


i have problem default behaviour in spring security authorize requests provided java config.

http        ....        .authorizerequests()           .antmatchers("/api/test/secured/*").authenticated() 

when call example /api/test/secured/user without login (with anonymous user), returns 403 forbidden. there easy way change status 401 unauthorized when anonymous user wants secured authenticated() or @preauthorize resource?

i've got solution here:

http    .authenticationentrypoint(authenticationentrypoint) 

authenticationentrypoint source code:

@component public class http401unauthorizedentrypoint implements authenticationentrypoint {      private final logger log = loggerfactory.getlogger(http401unauthorizedentrypoint.class);      /**      * returns 401 error code client.      */     @override     public void commence(httpservletrequest request, httpservletresponse response, authenticationexception arg2) throws ioexception,             servletexception {          log.debug("pre-authenticated entry point called. rejecting access");         response.senderror(httpservletresponse.sc_unauthorized, "access denied");     } } 

Comments

Popular posts from this blog

Magento/PHP - Get phones on all members in a customer group -

php - Bypass Geo Redirect for specific directories -

php - .htaccess mod_rewrite for dynamic url which has domain names -