UsernameNotFoundException thrown as 403 in spring boot

Viewed 2644

I have a spring boot project. When a request is made with incorrect user credentials :

catch (RuntimeException ex) {
        log.error("Error occurred while fetching user {}: {}", securityPrincipal, ex);
        throw new UsernameNotFoundException("Could not find user: " + securityPrincipal);
    }

But the exception thrown finally is a 500.

After going through a number of links I found that :

 protected AbstractPreAuthenticatedProcessingFilter multiPreAuthenticatedProcessingFilter() throws Exception {

        MultiPreAuthenticatedProcessingFilter filter = new MultiPreAuthenticatedProcessingFilter();

        filter.setAuthenticationManager(authenticationManager());
        filter.setPreAuthenticatedPrincipalProviders(preAuthenticatedPrincipalProviders);
        filter.setCheckForPrincipalChanges(true);
        filter.setInvalidateSessionOnPrincipalChange(true);
        filter.setContinueFilterChainOnUnsuccessfulAuthentication(**true**);

        return filter;
    }

Changing continueFilterChainOnUnsuccesfulAuthentication to true would help throw the Authentication exception as is. But after this was changed as true, the UsernameNotFoundException is thrown as a 403 instead of a 401.

Is there some basic security configuration that is missing?

1 Answers
Related