web/src/main/java/org/springframework/security/web/authentication/SimpleUrlAuthenticationFailureHandler.java
protected final void saveException(HttpServletRequest request,
			AuthenticationException exception) {
		if (forwardToDestination) {
			request.setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION, exception);
		}
		else {
			HttpSession session = request.getSession(false);

			if (session != null || allowSessionCreation) {
				request.getSession().setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION,
						exception);
			}
		}
	}
protected final void saveException(HttpServletRequest request,
			AuthenticationException exception) {
		if (forwardToDestination) {
			request.setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION, exception);
		}
		else {
			HttpSession session = request.getSession(false);

			if (session != null || allowSessionCreation) {
				request.getSession().setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION,
						exception);
			}
		}
	}
Caches the {@code AuthenticationException} for use in view rendering.
<p>
If {@code forwardToDestination} is set to true, request scope will be used,
otherwise it will attempt to store the exception in the session. If there is no
session and {@code allowSessionCreation} is {@code true} a session will be created.
Otherwise the exception will not be stored.