title: Spring Boot and XMLHttpRequest
body: <p>I am having a hard time understanding how Spring Boot (v1.3.3) handles the X-Requested-With: XMLHttpRequest header. My understanding is that this header tells Spring Boot to return, for requests without an authenticated session, a 401-Unauthorized error rather than a 302-Found with a location to the login page.</p>
  
  <p>I have set up my AngularJS client to send this header for any routing, and then configured an $http interceptor to act on the 401 error by displaying a dialog. Doesn't work for me, with a Spring Boot server with no additional security configuration.</p>
  
  <p>With some investigation with CURL:</p>
  
  <ol>
  <li>It seems that the <code>-H "Accept: application/json"</code> header also needs to be provided.</li>
  </ol>
  
  <p><code>curl -v -H "X-Requested-With: XMLHttpRequest" localhost:9080/</code> returns a 302, while <code>curl -v -H "X-Requested-With: XMLHttpRequest" -H "Accept: application/json" localhost:9080/</code> returns a 401.</p>
  
  <p>Questions: Why is the application/json header required as well? Can I configure it differently (i.e. not require application/json header)? Should I configure it this way, or take another approach? The reason I don't want to require the application/json header is because I am not allowing public access to some resources, such as HTML templates and JS code, and want a 401 returned for these resources as well.</p>
  
  <ol start="2">
  <li>It seems that the JSESSIONID cookie may be affecting the response.</li>
  </ol>
  
  <p><code>curl -v -H "X-Requested-With: XMLHttpRequest" -H "Accept: application/json" localhost:9080/</code> returns a 401, while <code>curl -v -H "X-Requested-With: XMLHttpRequest" -H "Accept: application/json" -H "Cookie: JSESSIONID=63EA6E09F64B98938E4495DF9898323A" localhost:9080/'</code> returns a 302.</p>
  
  <p>Questions: Why does the presence of the (valid) JSESSIONID cookie make any difference?</p>
  
  <p>I have looked at the source code for Spring Security and Spring Boot and I just cannot put together the pieces. Any help is much appreciated.</p>