web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java
protected void unsuccessfulAuthentication(HttpServletRequest request,
			HttpServletResponse response, AuthenticationException failed)
			throws IOException, ServletException {
		SecurityContextHolder.clearContext();

		if (logger.isDebugEnabled()) {
			logger.debug("Authentication request failed: " + failed.toString(), failed);
			logger.debug("Updated SecurityContextHolder to contain null Authentication");
			logger.debug("Delegating to authentication failure handler " + failureHandler);
		}

		rememberMeServices.loginFail(request, response);

		failureHandler.onAuthenticationFailure(request, response, failed);
	}
protected void unsuccessfulAuthentication(HttpServletRequest request,
			HttpServletResponse response, AuthenticationException failed)
			throws IOException, ServletException {
		SecurityContextHolder.clearContext();

		if (logger.isDebugEnabled()) {
			logger.debug("Authentication request failed: " + failed.toString(), failed);
			logger.debug("Updated SecurityContextHolder to contain null Authentication");
			logger.debug("Delegating to authentication failure handler " + failureHandler);
		}

		rememberMeServices.loginFail(request, response);

		failureHandler.onAuthenticationFailure(request, response, failed);
	}
Default behaviour for unsuccessful authentication.
<ol>
<li>Clears the {@link SecurityContextHolder}</li>
<li>Stores the exception in the session (if it exists or
<tt>allowSesssionCreation</tt> is set to <tt>true</tt>)</li>
<li>Informs the configured <tt>RememberMeServices</tt> of the failed login</li>
<li>Delegates additional behaviour to the {@link AuthenticationFailureHandler}.</li>
</ol>