title: Spring security BasicAuthenticationFilter returns 403 instead of 401
body: <p>I have implemented the JWT authentication and authorization. Everything is working fine, besides the unauthorized scenario</p>
  <p><strong>Unauthorized scenario</strong>: making a http call to a route without providing a authorization token.</p>
  <p><strong>Result</strong>: 403 forbidden instead of unauthorized</p>
  <p>Here is my code:</p>
  <pre><code>@Override
  protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException {
      String header = req.getHeader(HEADER_STRING);
  
      if (header == null || !header.startsWith(TOKEN_PREFIX)) {
          chain.doFilter(req, res);
          return;
      }
  
      UsernamePasswordAuthenticationToken authentication = getAuthentication(req);
  
      SecurityContextHolder.getContext().setAuthentication(authentication);
      chain.doFilter(req, res);
  }
  </code></pre>
  <p>After the</p>
  <pre><code>    if (header == null || !header.startsWith(TOKEN_PREFIX)) {
          chain.doFilter(req, res);
          return;
      } 
  </code></pre>
  <p>Executes, the response is 403</p>
  <p>Here is my full class:</p>
  <pre><code>public class JWTAuthorizationFilter extends BasicAuthenticationFilter {
  
      public JWTAuthorizationFilter(AuthenticationManager authenticationManager) {
          super(authenticationManager);
      }
  
      @Override
      protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException {
          String header = req.getHeader(HEADER_STRING);
  
          if (header == null || !header.startsWith(TOKEN_PREFIX)) {
              chain.doFilter(req, res);
              return;
          }
  
          UsernamePasswordAuthenticationToken authentication = getAuthentication(req);
  
          SecurityContextHolder.getContext().setAuthentication(authentication);
          chain.doFilter(req, res);
      }
  
      private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
  
          String token = request.getHeader(HEADER_STRING);
          if (token != null) {
  
              // setting the user in the security context
              String user = JWT.require(Algorithm.HMAC512(SECRET.getBytes()))
                      .build()
                      .verify(token.replace(TOKEN_PREFIX, &quot;&quot;))
                      .getSubject();
  
              if(user != null){
                  return new UsernamePasswordAuthenticationToken(user, null, new ArrayList&lt;&gt;());
              }
  
              return null;
          }
  
          return null;
      }
  }
  </code></pre>
  <p><strong>Remark</strong>:</p>
  <p>I had the same problem with <strong>UsernamePasswordAuthenticationFilter</strong>, and I solved it by overriding the default authenticationFailureHandler:</p>
  <pre><code>setAuthenticationFailureHandler(new JWTAuthenticationFailureHandler());
  </code></pre>
  <p>How can I get the correct 401 response code and body?</p>
  <p>Thanks!</p>