title: Is it a good practice to handle Authentication/Authorization errors using exceptions?
body: <p>If the application found that a user is not authenticated/authorized to do something, Is that an unexpected thing?</p>
  
  <pre><code>try {
      if (notAuth())
          throw new UnAuthException();
  } catch (UnAuthException e) {
      Log . error(e);
      return false;
  }
  </code></pre>
  
  <p><strong>if it is expected case</strong> , so why there are so many frameworks have their own <code>UnAuthException</code> if failed Auth is not exception ?</p>