AuthenticationEntryPoint handles the case where an unauthenticated request tries to access a protected resource — it's responsible for producing the response that tells the client how to authenticate (e.g., a 401 with a `WWW-Authenticate` header, or a redirect to a login page). AccessDeniedHandler handles the case where a request IS authenticated but lacks the required authority for the resource — producing a 403 response. Both are configurable via `exceptionHandling()` on the SecurityFilterChain, and mixing them up is a common source of returning the wrong status code (401 vs 403) for the wrong failure reason.

Advanced7 min

AmazonGoogleMicrosoftFlipkartOracleAdobe

#AuthenticationEntryPoint#AccessDeniedHandler

What is the difference between AuthenticationEntryPoint and AccessDeniedHandler?

This Maps Directly Back to the Authentication vs Authorization Distinction

These two handlers are simply the concrete mechanism implementing the earlier-established authentication-vs-authorization split: AuthenticationEntryPoint is triggered by an authentication failure (who are you?), AccessDeniedHandler by an authorization failure (what are you allowed to do?) — recognizing that connection makes it obvious which handler to configure for a given symptom, rather than needing to memorize the two class names independently.

Custom Handlers for Each Failure Type

java

http.exceptionHandling(ex -> ex
    .authenticationEntryPoint((req, res, e) -> res.sendError(401, "Authentication required"))
    .accessDeniedHandler((req, res, e) -> res.sendError(403, "Insufficient permissions")));