Authentication error

As explained in Spring Security in Action, Second Edition

An authentication failure is a failure to verify the identity represented by credentials submitted with a request.

An authentication error occurs when submitted credentials cannot verify an identity. Spring Security returns HTTP 401 Unauthorized and does not forward the request to the endpoint. section 8.1

Distinguish authentication failure from endpoint authorization:

• A request without credentials can reach an endpoint configured with permitAll(). section 8.1
• A request containing invalid credentials still enters authentication, fails verification, and receives 401 Unauthorized. section 8.1
• Authentication runs before authorization, so permitAll() does not allow a request with failed credentials to continue. section 8.1

Invalid credentials on a public endpoint

With /hola configured using anyRequest().permitAll(), curl http://localhost:8080/hola returns Hola! with 200 OK. Supplying curl -u bill:abcde http://localhost:8080/hola instead returns a 401 Unauthorized response. section 8.1

The authorization filter allows any request to the /hola path. However, because the application first executes the authentication logic, the request is never forwarded to the authorization filter. Instead, the authentication filter replies with an HTTP 401 Unauthorized.

Trace how the authentication filter rejects invalid credentials before the authorization filter can apply the endpoint's permitAll() rule. section 8.1

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains the 401 outcome and authentication-before-authorization sequence, without detailing credential-validation internals.

Examples

Uses the public /hola endpoint, valid and invalid curl credentials, and the resulting 200 OK or 401 Unauthorized responses.

What you can do after

Diagnose invalid credentials by identifying HTTP 401 responses even when endpoint authorization uses permitAll().

How it connects

Connects authentication with authorization, permitAll(), HTTP Basic authentication, and HTTP 401 Unauthorized responses.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

• 401 unauthorizedproduces · HTTP 401 Unauthorized is a response status indicating that a request lacks valid authentication credentials for the requested resource.
• client metricmeasured by · A client metric is an operational measurement describing the behavior, health, resource use, or traffic of a Kafka client.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.