Spring Security's default Http403ForbiddenEntryPoint was returning 403 for all auth failures. Frontend clients treat 403 as a permission error (not an auth error), so silent loops occurred instead of proper re-login. Adding a custom AuthenticationEntryPoint that returns 401 makes clients handle auth failures correctly (show login page on 401). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| java/com/xuqm/license | ||
| resources | ||