intermediateCustom AuthenticationProvider & Exception Handling

What is the difference between AuthenticationEntryPoint and AccessDeniedHandler, and which HTTP status does each typically produce?

AuthenticationEntryPoint handles AuthenticationException (the caller isn't authenticated at all) and typically results in HTTP 401 Unauthorized. AccessDeniedHandler handles AccessDeniedException (the caller IS authenticated but lacks sufficient permission) and typically results in HTTP 403 Forbidden. Both are invoked centrally by ExceptionTranslationFilter.

This is a Pro chapter

Sign in, then upgrade to Pro or Power to unlock this and the full Spring Ecosystem Mastery library.

What is the difference between AuthenticationEntryPoint and AccessDeniedHandler, and which HTTP status does each typically produce?

Next Step

Continue to Why is it dangerous to return the raw exception message from a login endpoint?← Back to all Spring Security questions