title: How to return http status code instead of login page in multi HttpSecurity case
body: <p>I have a spring boot app which provides HTML page service via <code>/</code> and also rest api via <code>/api</code>. The former requires login via a Login form and the later requires HTTP basic auth, and hereby, I configure two <code>HttpSecurity</code> section as follows:</p>
  <pre><code>@Configuration
  @Order(1)
  public static class ApiSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter { 
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.antMatcher(&quot;/api/**&quot;)
              .cors().and().csrf().disable()
              .authorizeRequests().anyRequest().authenticated()
                  .and()
                  .httpBasic(Customizer.withDefaults());
      }
  }
  
  @Configuration
  public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.antMatcher(&quot;/**&quot;)
                  .cors().disable()
                  .authorizeRequests()
                  .antMatchers(&quot;/login&quot;, &quot;/js/**&quot;, &quot;/css/**&quot;).permitAll()
                  .antMatchers(&quot;/**&quot;).hasRole(&quot;ADMIN&quot;)
                  .and().formLogin().loginPage(&quot;/login&quot;).permitAll().defaultSuccessUrl(&quot;/index&quot;)
                  .and().logout().invalidateHttpSession(true)
                  .deleteCookies(&quot;JSESSIONID&quot;).logoutSuccessUrl(&quot;/login&quot;).permitAll();
      }
  }
  </code></pre>
  <p>The configuration works perfectly in normal case. However, if wrong credentials are provides in rest api clients, an HTML code of login page with HTTP status code 200 returns from the app instead of an excepted json message with HTTP status code 401 or 403.</p>
  <p>I'm afraid it is because the url pattern of <code>/api/**</code> both matches  <code>&quot;/api/**&quot;</code> and <code>&quot;/**&quot;</code>, and therefore, the request will pass both the filter chain for rest api and HTML page. Finally, because of the lower order of <code>formLogin</code>, a login page returns in the case.</p>
  <p>So, How can I get the excepted result for rest api clients? Is there an only solution to separate the two url patterns which should not match each other?</p>
  <p>Addition 1:</p>
  <p>I think there are three cases which will raise exceptions in the security filter chain:</p>
  <ol>
  <li>No credentials provided;</li>
  <li>Wrong credentials provided;</li>
  <li>Right credentials provided but not matched the required roles</li>
  </ol>
  <p>And the results for the cases are as follows:</p>
  <ol>
  <li>Return HTTP status 401 with a json error message</li>
  <li>Return HTTP status 302 and try to redirect to login page</li>
  <li>Return HTTP status 403 with a json error message</li>
  </ol>
  <p>Therefore, it seems that only the case of wrong credentials provided will
  be routed to <code>/error</code> endpoint (as what Eleftheria said in the answer), and the difference between 1,3 and 2 is the exception type -- <code>org.springframework.security.access.AccessDeniedException: Access is denied</code> for 1 and 3; <code> org.springframework.security.authentication.BadCredentialsException: Bad credentials</code> for 2.</p>
  <p>In the <code>formLogin()</code> case, if the <code>BadCredentialsException</code> rises, it will be routed to the <code>failure-url</code>, but how to configure the <code>failure-url</code> in the <code>httpbasic</code> case? (seems no such method in <code>HttpBasicConfigurer</code>)</p>