How do you handle 401 versus 403 responses in Spring Security?

Separates authentication challenge from denied authorization and traces the selected entry point, denied handler, and matched rule.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Spring Security uses an AuthenticationEntryPoint when a request needs authentication, which normally produces 401 for an API and may include a WWW-Authenticate challenge. It uses an AccessDeniedHandler when an authenticated caller lacks authority, which normally produces 403. An anonymous caller denied by an authorization rule may be sent to the entry point because authenticating could change the outcome.

Full answer below

Practice focus

AuthenticationEntryPoint, AccessDeniedHandler, anonymous users, bearer challenges, error contracts, and diagnostics.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
401 means acceptable authentication is missing or failed; 403 means the caller is known but not allowed.
Spring Security uses an AuthenticationEntryPoint when a request needs authentication, which normally produces 401 for an API and may include a WWW-Authenticate challenge. It uses an AccessDeniedHandler when an authenticated caller lacks authority, which normally produces 403. An anonymous caller denied by an authorization rule may be sent to the entry point because authenticating could change the outcome.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I reproduce the exact method, path, headers, selected filter chain, authentication type, authorities, and matched rule. An invalid bearer token is an authentication failure, while a valid token missing a required scope is authorization failure. I customize both handlers to return the API's safe, stable error shape without leaking whether another user's resource exists. CORS or CSRF rejection can look similar from the browser and must be identified separately.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Returning 403 for every authentication failure.
Returning 401 for a valid user missing permission.
Leaking resource existence in a detailed denial.

How do you handle 401 versus 403 responses in Spring Security?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Try a variant

Tech stacks

Skill areas

Suggest an improvement

Found this answer useful?