Unauthorized response with XMLHttpRequest header

I use Spring Boot with Spring Security basic authentication. When i send request with wrong password, i’ll receive normal error message in body:

{
    "timestamp": "2018-01-15T11:59:31.837+0000",
    "status": 401,
    "error": "Unauthorized",
    "message": "Bad credentials",
    "path": "/karbonator/api/v1/wallet"
}

But when i add additional header X-Requested-With: XMLHttpRequest to the request, i’ll receive only status 401 and no body.

Code sample is here: https://github.com/rublin/XMLHttpRequest

[wilkinsona]

I think that Spring Security issue explains why its a 401 rather than a 302 to a login page. It doesn’t explain, to me anyway, why you get a 401 with a body in the first case and a 401 without a body in the second case.

[wilkinsona]

I’ve dug into this a bit more.

Without the X-Requested-With: XMLHttpRequest header, DelegatingAuthenticationEntryPoint doesn’t find a matching entry point so it falls back to the default. This is BasicAuthenticationEntryPoint. It calls sendError on the HttpServletResponse. This then results in the response being forwarded to Boot’s custom error page that produces the expected JSON response body.

When the X-Requested-With: XMLHttpRequest header is sent, DelegatingAuthenticationEntryPoint finds a matching HttpStatusEntryPoint. It calls response.setStatus and, as it’s not considered to be an error, an empty 401 response is returned.

This behaviour is out of Spring Boot’s control so I am going to close this in favour of the Spring Security issue.