Fixing 401 Unauthorized Spring Security Errors in a React-Spring App with Custom Authentication

Solution 1: Updating Spring Security Configuration for Stateless Session Management

This approach uses Spring Security's stateless session policy to resolve session management in a REST API context, which is optimized for single-page applications (SPAs) like React. Here, we adjust the SecurityFilterChain configuration to match a REST API stateless model.

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
        .csrf(csrf -> csrf.disable())  // Disable CSRF for REST APIs
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/user/register", "/user/login").permitAll()
            .anyRequest().authenticated()
        )
        .httpBasic(Customizer.withDefaults())
        .sessionManagement(session ->
            session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        )
        .build();
}

Solution 2: Custom Authentication Filter for Token-Based Authentication

In this solution, a custom filter authenticates the user and attaches a token in the response header. This filter uses token-based authentication, which is ideal for RESTful applications and can work seamlessly with React.

@Component
public class CustomAuthFilter extends OncePerRequestFilter {
    private final AuthenticationManager authenticationManager;
    public CustomAuthFilter(AuthenticationManager authManager) {
        this.authenticationManager = authManager;
    }
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain)
                                    throws ServletException, IOException {
        String authHeader = request.getHeader("Authorization");
        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            String token = authHeader.substring(7);
            Authentication authentication = new UsernamePasswordAuthenticationToken(token, null);
            Authentication authResult = authenticationManager.authenticate(authentication);
            SecurityContextHolder.getContext().setAuthentication(authResult);
        }
        filterChain.doFilter(request, response);
    }
}

Solution 3: Service Class Adjustments and Token Response

This service implementation sends a JWT token on successful login, using modular design to ensure each function is testable and reusable across the application.

@Service
public class AuthenticationService {
    private final AuthenticationManager authenticationManager;
    private final TokenProvider tokenProvider; // Custom class for generating JWTs
    public AuthenticationService(AuthenticationManager authenticationManager,
                                 TokenProvider tokenProvider) {
        this.authenticationManager = authenticationManager;
        this.tokenProvider = tokenProvider;
    }
    public String authenticateAndGenerateToken(LoginDTO loginDTO) {
        Authentication authentication = authenticationManager
            .authenticate(new UsernamePasswordAuthenticationToken(loginDTO.getUserName(),
                                                                loginDTO.getPassword()));
        SecurityContextHolder.getContext().setAuthentication(authentication);
        return tokenProvider.createToken(authentication);
    }
}

Unit Test for Token Generation and Authentication

This JUnit test ensures that authentication and token generation work correctly and validate the authentication for accessing secure resources.

@SpringBootTest
@AutoConfigureMockMvc
public class AuthenticationServiceTest {
    @Autowired
    private MockMvc mockMvc;
    @MockBean
    private AuthenticationService authenticationService;
    @Test
    public void testAuthenticateAndGenerateToken() throws Exception {
        LoginDTO loginDTO = new LoginDTO("user", "password");
        String token = authenticationService.authenticateAndGenerateToken(loginDTO);
        mockMvc.perform(MockMvcRequestBuilders.post("/login")
                .contentType(MediaType.APPLICATION_JSON)
                .content("{\\"userName\\":\\"user\\", \\"password\\":\\"password\\"}"))
                .andExpect(status().isOk())
                .andExpect(header().exists("Authorization"))
                .andExpect(content().string("Successfully Authenticated"));
    }
}

Common Questions About Spring Security Custom Authentication Issues

1. Why do I still get a 401 Unauthorized error even after setting the SecurityContextHolder?
2. The 401 error often occurs if the authentication context doesn’t persist. Ensure you are using token-based authentication if your application is stateless.
3. How do I enable stateless session management in Spring Security?
4. Set SessionCreationPolicy.STATELESS in your SecurityFilterChain to ensure that each request is independently authenticated.
5. What is the role of DaoAuthenticationProvider in custom authentication?
6. The DaoAuthenticationProvider verifies user credentials against your database and encodes passwords for secure authentication.
7. Can I use JWT tokens for session management in Spring Security?
8. Yes, JWT tokens are ideal for stateless applications. Generate a token after authentication and include it in the header for subsequent requests.
9. How does CSRF protection affect stateless APIs?
10. CSRF protection is typically disabled in stateless APIs using csrf().disable() since it’s unnecessary for APIs without sessions.
11. What if I want to allow public access to some endpoints like login or register?
12. Use authorizeHttpRequests and specify the endpoints that should be accessible without authentication using permitAll().
13. How do I store tokens on the client side with React?
14. Store tokens in localStorage or sessionStorage, then include them in each request’s header to ensure the backend can authenticate each request.
15. Is it safe to disable CSRF for APIs?
16. Disabling CSRF for APIs is safe if your app relies on tokens or doesn’t use cookies, as CSRF mainly protects against cookie-based attacks.
17. What is the function of OncePerRequestFilter in custom authentication?
18. This filter executes only once per request, ensuring that authentication logic applies consistently without redundant checks in the request cycle.
19. Why might my authentication token not be recognized across different endpoints?
20. Ensure you set the token in each request’s header and confirm it’s correctly validated on the server using a consistent token verification process.
21. How can I test my Spring Security configuration?
22. Use MockMvc in your tests to simulate requests, check the authentication responses, and validate that protected endpoints are only accessible after login.

Final Thoughts on Resolving 401 Errors in Custom Spring Security Authentication

Successfully securing a Spring-based application with a custom login page requires careful configuration, especially if using stateless sessions or token-based approaches. When integrating with a React frontend, ensuring that your security configuration aligns with RESTful, stateless principles can help avoid session issues.

From modifying SecurityFilterChain settings to implementing token-based flows, each approach plays a role in creating a reliable authentication setup. By understanding session management, token handling, and the SecurityContext, you’ll be well-equipped to solve 401 Unauthorized errors in your Spring Security applications. 🔒