title: Spring Boot: disable security for status exception code
body: <p>I have a Spring Boot application, with security. And I have removed the authentication for this "/login" url.</p>
  
  <p>My Security Configuration</p>
  
  <pre><code>@Configuration
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
      private final JwtFilter jwtFilter;
  
      @Autowired
      public SecurityConfiguration(JwtFilter jwtFilter) {
          this.jwtFilter = jwtFilter;
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable()
                  .anonymous().and()
                  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                  .authorizeRequests()
                  .anyRequest().authenticated().and()
                  .apply(new JwtConfigurerAdapter(jwtFilter)).and()
                  .exceptionHandling().authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));
      }
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring().antMatchers("/v2/api-docs");
          web.ignoring().antMatchers("/login");
      }
  }
  </code></pre>
  
  <p>My NotFound exception</p>
  
  <pre><code>@ResponseStatus(value = HttpStatus.NOT_FOUND)
  public class NotFound extends RuntimeException {
      public NotFound(String message) {
          super(message);
      }
  }
  </code></pre>
  
  <p>My rest controller with login url and exception return value</p>
  
  <pre><code>@RestController
  public class LoginController implements LoginService {
      @Override
      @GetMapping(value = "/login", produces = MediaType.APPLICATION_JSON_VALUE)
      public UserInfo loginUsingJson(String username, String password) {
          return findUser(username, password)).orElseThrow(() -&gt; new NotFound("There does not exist any user by those credentials"));
      }
  }
  </code></pre>
  
  <p>Okay, here is my problem. When I call GET on "/login" and the UserInfo exists, it will return the user as JSON. This works because of <code>web.ignoring().antMatchers("/login");</code>, but if the user does <strong>not</strong> exist, then the exception NotFound with the http error code 404, will not show. It is now returning error code 401 Not Authorized.</p>
  
  <p>I'm guessing it has something todo with HttpSecurity, where I have to add some exception or something so the exception code can be returned.
  But where do I allow exception handling to be ignored in the authorization of HttpSecurity?</p>