intermediateCustom AuthenticationProvider & Exception Handling

What is the difference between AuthenticationEntryPoint and AccessDeniedHandler, and which HTTP status does each typically produce?

AuthenticationEntryPoint handles AuthenticationException (the caller isn't authenticated at all) and typically results in HTTP 401 Unauthorized. AccessDeniedHandler handles AccessDeniedException (the caller IS authenticated but lacks sufficient permission) and typically results in HTTP 403 Forbidden. Both are invoked centrally by ExceptionTranslationFilter.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to Why is it dangerous to return the raw exception message from a login endpoint? →← Back to all Spring Security questions