beginnerFoundations: What Is Security, and Why Should You Care?
Why is HTTP 401 sometimes confusingly called 'Unauthorized' when it's actually about authentication?
This is a historical naming inconsistency in the HTTP specification itself, not a Spring Security quirk. HTTP 401 Unauthorized technically means 'you are not authenticated — please provide valid credentials,' while HTTP 403 Forbidden means 'you are authenticated, but you don't have permission.' Spring Security correctly maps AuthenticationException to 401 and AccessDeniedException to 403, despite the confusing HTTP status text.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response