I have a spring boot project. When a request is made with incorrect user credentials :
catch (RuntimeException ex) {
log.error("Error occurred while fetching user {}: {}", securityPrincipal, ex);
throw new UsernameNotFoundException("Could not find user: " + securityPrincipal);
}
But the exception thrown finally is a 500.
After going through a number of links I found that :
protected AbstractPreAuthenticatedProcessingFilter multiPreAuthenticatedProcessingFilter() throws Exception {
MultiPreAuthenticatedProcessingFilter filter = new MultiPreAuthenticatedProcessingFilter();
filter.setAuthenticationManager(authenticationManager());
filter.setPreAuthenticatedPrincipalProviders(preAuthenticatedPrincipalProviders);
filter.setCheckForPrincipalChanges(true);
filter.setInvalidateSessionOnPrincipalChange(true);
filter.setContinueFilterChainOnUnsuccessfulAuthentication(**true**);
return filter;
}
Changing continueFilterChainOnUnsuccesfulAuthentication to true would help throw the Authentication exception as is. But after this was changed as true, the UsernameNotFoundException is thrown as a 403 instead of a 401.
Is there some basic security configuration that is missing?