title: UsernameNotFoundException thrown as 403 in spring boot
body: <p>I have a spring boot project. When a request is made with incorrect user credentials :</p>
  
  <pre><code>catch (RuntimeException ex) {
          log.error("Error occurred while fetching user {}: {}", securityPrincipal, ex);
          throw new UsernameNotFoundException("Could not find user: " + securityPrincipal);
      }
  </code></pre>
  
  <p>But the exception thrown finally is a 500.</p>
  
  <p>After going through a number of links I found that :</p>
  
  <pre><code> protected AbstractPreAuthenticatedProcessingFilter multiPreAuthenticatedProcessingFilter() throws Exception {
  
          MultiPreAuthenticatedProcessingFilter filter = new MultiPreAuthenticatedProcessingFilter();
  
          filter.setAuthenticationManager(authenticationManager());
          filter.setPreAuthenticatedPrincipalProviders(preAuthenticatedPrincipalProviders);
          filter.setCheckForPrincipalChanges(true);
          filter.setInvalidateSessionOnPrincipalChange(true);
          filter.setContinueFilterChainOnUnsuccessfulAuthentication(**true**);
  
          return filter;
      }
  </code></pre>
  
  <p>Changing continueFilterChainOnUnsuccesfulAuthentication to true would help throw the Authentication exception as is. But after this was changed as true, the UsernameNotFoundException is thrown as a 403 instead of a 401. </p>
  
  <p>Is there some basic security configuration that is missing?</p>