Question

I am using spring basic authentication with the following settings in my security xml:

<http use-expressions="true" create-session="never" >
        <intercept-url pattern="/**" method="GET" access="isAuthenticated()" />
        <intercept-url pattern="/**" method="POST" access="isAuthenticated()" />
        <intercept-url pattern="/**" method="PUT" access="isAuthenticated()" />
        <intercept-url pattern="/**" method="DELETE" access="isAuthenticated()" />
        <http-basic />
    </http>

If authentication fails, the browser pop ups a prompt window to renter the user name and password.
Is there any way to make that prompt not pop up at all ?

Answer 1

Most probable the page that is used for authentication failure is also protected. You can try manually to set the failure page to one that is not protected like

 <access-denied-handler error-page="/login.jsp"/> 

together with

 <intercept-url pattern="/*login*" access="hasRole('ROLE_ANONYMOUS')"/>

or

<intercept-url pattern='/*login*' filters='none'/>  

or you can use the auto-config='true' attribute of the http element that will fix that for you.See more here