Scenario 2: A user reports they can log in but every request afterward returns 401, even though their username/password is correct.

This usually points to a broken SESSION or TOKEN persistence issue rather than credential validation: for session-based auth, check that the session cookie is actually being sent back by the client (common issue: SameSite/secure cookie flags misconfigured for local HTTP testing, or a missing withCredentials on the frontend HTTP client); for JWT, check that the client is actually attaching the Authorization: Bearer header on subsequent requests, and that the JwtValidationFilter is registered correctly in the filter chain before the authorization check.