beginnerSpring Security Architecture: The Filter Chain & Internal Flow

What is the difference between AuthenticationEntryPoint and AccessDeniedHandler?

AuthenticationEntryPoint handles the case where a request is unauthenticated but requires authentication (HTTP 401) — e.g., redirecting to a login page or sending a WWW-Authenticate challenge. AccessDeniedHandler handles the case where a request IS authenticated but lacks sufficient authority (HTTP 403) — e.g., rendering a custom 'access denied' page or JSON error body.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to What is the difference between UserDetailsService and UserDetailsManager? →← Back to all Spring Security questions