spring-projects / spring-projects/spring-security
Document Authentication Semantics for Public Endpoints
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
A common question is "why do my public endpoints fail with a 401 when they are given invalid credentials?"
The answer I usually give is:
This is by design. Generally speaking, an authorization system would need to know who the user is before knowing whether the user can do X, Y, or Z operation. And even with a public endpoint, the endpoint may behave differently when a user is in context. So, in the end, they are separate systems with authentication coming first: If a request presents credentials, then the framework will try and authenticate the user and accept or deny the request accordingly.
This should be documented somewhere, including how to configure public endpoints so that they never attempt authentication.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Spring Security documentation covering public endpoints and authentication behavior. Document why invalid credentials produce a 401 on public endpoints and explain how to configure public endpoints so they never attempt authentication; confirm the guidance against the existing documentation structure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100