Spring Security is returning 403 instead of 404

Question

I have implemented two endpoints:

1. /sample -> which return the word 'sample'
2. /api/v1/current -> which return the word 'current'

And I have configured Spring Security as follows, to permit /api/** if authenticated.

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    private ResourceOwnershipFilter filter;

    @Bean
    @Profile({"dev"})
    public SecurityFilterChain configureSecurity(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests(authorize -> authorize
                        .requestMatchers("/swagger-ui/**", "/v3/**").permitAll()
                        .requestMatchers("/api/**").authenticated()
                )
                .csrf().disable()
                .cors().disable()
                .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and()
                .formLogin().disable()
                .httpBasic().disable()
                .addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class)
                .build();
    }
}

I dont understand why requests made to /api/v1/doesnotexists return 403 (Access Denied) instead of 404 (Not Found)?

I can confirm that all requests are authenticated

Answer 1

This is expected behaviour to prevent leakage of path info. Have a look at this answer.