Spring-boot: Remove Http401AuthenticationEntryPoint

[rwinch]

As far as I can tell it is not being used in the Spring Boot code base, so it might be good to remove Http401AuthenticationEntryPoint.

[workmanw]

Out of curiosity, what would the advice be for users of 1.x who were using this manually? Ex:

public class MySecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.exceptionHandling().authenticationEntryPoint(new Http401AuthenticationEntryPoint("Unauthorized"));
  }
}

Should we just create our own Http401AuthenticationEntryPoint?

---

UPDATE:

A colleague pointed out to me that if I don't care about the WWW-Authenticate header value and just want the HTTP Status (which was the case for me), I could just use HttpStatusEntryPoint. Ex:

import org.springframework.http.HttpStatus;
import org.springframework.security.web.authentication.HttpStatusEntryPoint;

public class MySecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.exceptionHandling().authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));
  }
}

Just a helpful tip for anyone else who comes across this.

[rwinch]

There is also the BasicAuthenticationEntryPoint

[mdvorak]

Note that with 401 header WWW-Authenticate is mandatory due to HTTP specification.
Http401AuthenticationEntryPoint was convenient to provide it. I had real trouble finding this issue.

Please add it to CHANGELOG somewhere. A lot of people will depend on it manually.

I would actually welcome this utility class to be present in Spring Security, alongside with Http403ForbiddenEntryPoint.