title: Spring Security with basic auth redirecting to /error for invalid credentials
body: <p>I have a spring boot application running with spring security using basic auth.
  When proper basic auth credentials are supplied, everything is good, but for incorrect auth credentials, spring comes up with a <code>HttpRequestMethodNotSupportedException: Request method 'POST' not supported</code> exception.</p>
  
  <p>According to the logs, the authentication failure has been identified by spring, but that's not what comes out.</p>
  
  <p><code>2015-08-12 09:33:10.922  INFO 16988 --- [nio-8080-exec-4] o.s.b.a.audit.listener.AuditListener     : AuditEvent [timestamp=Wed Aug 12 09:33:10 AEST 2015, principal=anonymousUser, type=AUTHORIZATION_FAILURE, data={type=org.springframework.security.access.AccessDeniedException, message=Access is denied}]
  2015-08-12 09:33:10.927 TRACE 16988 --- [nio-8080-exec-4] o.s.web.servlet.DispatcherServlet        : Bound request context to thread: FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@483e1fc6]
  2015-08-12 09:33:10.927 DEBUG 16988 --- [nio-8080-exec-4] o.s.web.servlet.DispatcherServlet        : DispatcherServlet with name 'dispatcherServlet' processing POST request for [/myapplication/error]
  2015-08-12 09:33:10.927 TRACE 16988 --- [nio-8080-exec-4] o.s.web.servlet.DispatcherServlet        : Testing handler map [org.springframework.web.servlet.handler.SimpleUrlHandlerMapping@331bb032] in DispatcherServlet with name 'dispatcherServlet'
  2015-08-12 09:33:10.927 TRACE 16988 --- [nio-8080-exec-4] o.s.w.s.handler.SimpleUrlHandlerMapping  : No handler mapping found for [/error]
  2015-08-12 09:33:10.927 TRACE 16988 --- [nio-8080-exec-4] o.s.web.servlet.DispatcherServlet        : Testing handler map [org.springframework.boot.actuate.endpoint.mvc.EndpointHandlerMapping@69e79b9b] in DispatcherServlet with name 'dispatcherServlet'
  2015-08-12 09:33:10.927 TRACE 16988 --- [nio-8080-exec-4] o.s.web.servlet.DispatcherServlet        : Testing handler map [org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping@27cc0354] in DispatcherServlet with name 'dispatcherServlet'
  2015-08-12 09:33:10.927 DEBUG 16988 --- [nio-8080-exec-4] s.w.s.m.m.a.RequestMappingHandlerMapping : Looking up handler method for path /error
  2015-08-12 09:33:10.928 DEBUG 16988 --- [nio-8080-exec-4] .m.m.a.ExceptionHandlerExceptionResolver : Resolving exception from handler [null]: org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported</code></p>
  
  <p>With the above logs &amp; after debugging the spring source, I found out that upon identifying that the credentials are incorrect, spring creates a BadCredentials exception and then tries to redirect to “/error”, this redirection is what causes the HttpMethodNotAllowed exception.(my application doesn't have a /error endpoint).</p>
  
  <p>I tried to tell spring not to use /error by configuring the following,</p>
  
  <p>`public class ServerCustomization extends ServerProperties {</p>
  
  <pre><code>@Override
  public void customize(ConfigurableEmbeddedServletContainer container) {
  
      super.customize(container);
      container.addErrorPages(new ErrorPage(HttpStatus.UNAUTHORIZED, null));
  
  }`
  </code></pre>
  
  <p>This will make spring stop spitting out the HttpMethodnotallowed exception and make it come up with a 401(Unauthorized), BUT my this exception is not caught by my Exception handler (configured using <code>@ControllerAdvice</code>).</p>
  
  <p>I also tried configuring a custom authentication entry point like below without any luck.</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  AlwaysSendUnauthorized401AuthenticationEntryPoint alwaysSendUnauthorized401AuthenticationEntryPoint = 
          new AlwaysSendUnauthorized401AuthenticationEntryPoint();
  
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.headers().httpStrictTransportSecurity().xssProtection().and().authorizeRequests().anyRequest().fullyAuthenticated()
              .and().csrf().disable();
  
      http.exceptionHandling().authenticationEntryPoint(alwaysSendUnauthorized401AuthenticationEntryPoint);
  }
  
  public class AlwaysSendUnauthorized401AuthenticationEntryPoint implements AuthenticationEntryPoint {
      @Override
      public final void commence(HttpServletRequest request, HttpServletResponse response,
              AuthenticationException authException) throws IOException {
          response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
      }
  }
  </code></pre>
  
  <p>}</p>
  
  <p>Is there any way we can specify to spring not to redirect to /error and return the Bad Credentials Exception ?</p>