title: Spring boot + Spring Security: how to suppress the basic auth form
body: <p>Good day.</p>
  
  <p>I am using Spring security in context of Spring boot auto-configured application. My goal is to set up basic auth in such way that standard browser's basic auth form is not shown on 401. From the Google I found out that to achieve it I need to change the default "WWW-Authenticate" header to something different than "Basic xxxxx".</p>
  
  <p>To do that, I declared a filter:</p>
  
  <pre><code>@Bean
  @Order(Integer.MAX_VALUE)
  public Filter customAuthFilter() {
      return new Filter() {
  
          @Override
          public void init(FilterConfig fc) throws ServletException {
          }
  
          @Override
          public void doFilter(ServletRequest sreq, ServletResponse sresp, FilterChain fc) throws IOException, ServletException {
              HttpServletRequest req = (HttpServletRequest) sreq;
              HttpServletResponse resp = (HttpServletResponse) sresp;
  
              fc.doFilter(req, resp);
              log.info("filter");
              log.info("status " + resp.getStatus());
              if(resp.getStatus() == 401) {
                  resp.setHeader("WWW-Authenticate", "Client-driven");
              }
          }
  
          @Override
          public void destroy() {
          }
      };
  </code></pre>
  
  <p>From the logs I see that my filter successfully recognized by the application and takes participation in processing responses (I see the log messages from doFilter). But the actual response, received by browser, still contains the standard 'WWW-Authenticate' header. It seems that someone overrides my header, by I don't have a clue who it is exactly.</p>
  
  <p>Could someone give an advice please?</p>