Pfthb

With Spring Boot 1.5.6.RELEASE I was able to send HTTP Status code 401 instead of 403 as described in How let spring security response unauthorized(http 401 code) if requesting uri without authentication, by doing this:

public class SecurityConfig extends WebSecurityConfigurerAdapter 

 @Override
 protected void configure(HttpSecurity http) throws Exception 
 //...
 http.exceptionHandling()
 .authenticationEntryPoint(new Http401AuthenticationEntryPoint("myHeader"));
 //...
 

using the org.springframework.boot.autoconfigure.security.Http401AuthenticationEntryPoint class.

I just upgraded to Spring Boot 2.0.0.RELEASE and found there is not such class any more (at least in that package).

Q:
Does this class (Http401AuthenticationEntryPoint) exist yet in Spring Boot? If no, what could be a good alternative for keeping the same behavior in an existing project in order to keep consistency with other implementations which depend on this status code (401) instead of 403?

The class org.springframework.boot.autoconfigure.security.Http401AuthenticationEntryPoint was removed in favor of org.springframework.security.web.authentication.HttpStatusEntryPoint.

In my case the code would go like this:

public class SecurityConfig extends WebSecurityConfigurerAdapter 

 @Override
 protected void configure(HttpSecurity http) throws Exception 
 //...
 http.exceptionHandling()
 .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));
 //...
 

Http401AuthenticationEntryPoint was removed, see 10715:

Remove Http401AuthenticationEntryPoint

rwinch commented on 20 Oct 2017

As far as I can tell it is not being used in the Spring Boot code base, so it might be good to remove Http401AuthenticationEntryPoint.

Depending on your requirements, you could use:

• HttpStatusEntryPoint


• BasicAuthenticationEntryPoint

Just to elaborate @lealceldeiro's answer:

Before Spring Boot 2 my Securiy Configuration class looked like this:

@Configuration
public class MyConfig extends WebSecurityConfigurerAdapter 

 @Bean
 public Http401AuthenticationEntryPoint securityException401EntryPoint() 
 return new Http401AuthenticationEntryPoint("Bearer realm="webrealm"");
 

 @Autowired
 private Http401AuthenticationEntryPoint authEntrypoint;

 @Override
 protected void configure(HttpSecurity http) throws Exception 

 // some http configuration ...

 // Spring Boot 1.5.x style
 http.exceptionHandling().authenticationEntryPoint(authEntrypoint);
 
//...

And now in Spring Boot 2 it looks like this:

@Configuration
public class MyConfig extends WebSecurityConfigurerAdapter 

 //Bean configuration for Http401AuthenticationEntryPoint can be removed

 //Autowiring also removed

 @Override
 protected void configure(HttpSecurity http) throws Exception 

 // some http configuration ...

 // Spring Boot 2 style
 http.exceptionHandling().authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));
 
//...

See also here: https://github.com/spring-projects/spring-boot/issues/10715#issuecomment-363592444

you can customize your logic with overriding the class AuthenticationEntryPoint
this should be working :

@Component public class AuthEntryPointException implements AuthenticationEntryPoint, Serializable 

 private static final long serialVersionUID = -8970718410437077606L;

 @Override
 public void commence(HttpServletRequest request, HttpServletResponse response,
 AuthenticationException authException) throws IOException 
 response.setStatus(HttpStatus.SC_UNAUTHORIZED);
 response.setContentType("application/json");
 response.getWriter().write(""result":"UNAUTHORIZED","message":"UNAUTHORIZED or Invalid Token"");