java - Spring Security anonymous 401 instead of 403 -
i have problem default behaviour in spring security authorize requests provided java config.
http .... .authorizerequests() .antmatchers("/api/test/secured/*").authenticated()
when call example /api/test/secured/user
without login (with anonymous user), returns 403 forbidden. there easy way change status 401 unauthorized when anonymous user wants secured authenticated()
or @preauthorize
resource?
i've got solution here:
http .authenticationentrypoint(authenticationentrypoint)
authenticationentrypoint source code:
@component public class http401unauthorizedentrypoint implements authenticationentrypoint { private final logger log = loggerfactory.getlogger(http401unauthorizedentrypoint.class); /** * returns 401 error code client. */ @override public void commence(httpservletrequest request, httpservletresponse response, authenticationexception arg2) throws ioexception, servletexception { log.debug("pre-authenticated entry point called. rejecting access"); response.senderror(httpservletresponse.sc_unauthorized, "access denied"); } }
Comments
Post a Comment