advancedScenario Questions

Scenario 2: A user reports they can log in but every request afterward returns 401, even though their username/password is correct.

This usually points to a broken SESSION or TOKEN persistence issue rather than credential validation: for session-based auth, check that the session cookie is actually being sent back by the client (common issue: SameSite/secure cookie flags misconfigured for local HTTP testing, or a missing withCredentials on the frontend HTTP client); for JWT, check that the client is actually attaching the Authorization: Bearer header on subsequent requests, and that the JwtValidationFilter is registered correctly in the filter chain before the authorization check.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to Scenario 3: Two different microservices (Accounts and Loans) both trust the same Keycloak realm. How do you prevent a token meant for Accounts from being replayed against Loans? →← Back to all Spring Security questions