title: Customize authentication failure response in Spring Security using AuthenticationFailureHandler
body: <p>Currently, whenever a user fails authentication, spring security responds with: </p>
  
  <pre><code>{"error": "invalid_grant","error_description": "Bad credentials"}
  </code></pre>
  
  <p>And I would like to enhance this response with a response code like:</p>
  
  <pre><code>{"responsecode": "XYZ","error": "invalid_grant","error_description": "Bad credentials"}
  </code></pre>
  
  <p>After some poking around, it looks like what I need to do this is implement an AuthenticationFailureHandler, which I have begun to do. However, the onAuthenticationFailure method never seems to be reached whenever I submit invalid login credentials. I have stepped through the code, and placed logging in the onAuthenticationFailure method to confirm it is not being reached. </p>
  
  <p>My failure handler is:</p>
  
  <pre><code>@Component
  public class SSOAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler{
  
      @Override
      public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
          AuthenticationException exception) throws IOException, ServletException {
          super.onAuthenticationFailure(request, response, exception);
          response.addHeader("responsecode", "XYZ");  
      }
  }
  </code></pre>
  
  <p>And my WebSecurityConfigurerAdapter contains:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired SSOAuthenticationFailureHandler authenticationFailureHandler;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable();
          http.formLogin().failureHandler(authenticationFailureHandler);
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(service).passwordEncoder(passwordEncoder());
          auth.authenticationEventPublisher(defaultAuthenticationEventPublisher());
      }
  
      @Bean
      public DefaultAuthenticationEventPublisher defaultAuthenticationEventPublisher(){
          return new DefaultAuthenticationEventPublisher();
      }
  
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Bean
      public SSOAuthenticationFailureHandler authenticationHandlerBean() {
          return new SSOAuthenticationFailureHandler();
      }
  
      @Bean
      public PasswordEncoder passwordEncoder(){
          PasswordEncoder encoder = new BCryptPasswordEncoder();
          return encoder;
      }
  }
  </code></pre>
  
  <p>My questions are:</p>
  
  <ol>
  <li>Is this the right way to achieve the result I want? (Customizing the spring security authentication response)</li>
  <li>If so, did I do something wrong trying to set up my authentication failure handler (since a bad login doesn't seem to be reaching the onAuthenticationFailure method? </li>
  </ol>
  
  <p>Thank you!</p>