web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java
protected void unsuccessfulAuthentication(HttpServletRequest request,
			HttpServletResponse response, AuthenticationException failed)
			throws IOException, ServletException {
		SecurityContextHolder.clearContext();

		if (logger.isDebugEnabled()) {
			logger.debug("Authentication request failed: " + failed.toString(), failed);
			logger.debug("Updated SecurityContextHolder to contain null Authentication");
			logger.debug("Delegating to authentication failure handler " + failureHandler);
		}

		rememberMeServices.loginFail(request, response);

		failureHandler.onAuthenticationFailure(request, response, failed);
	}
protected void unsuccessfulAuthentication(HttpServletRequest request,
			HttpServletResponse response, AuthenticationException failed)
			throws IOException, ServletException {
		SecurityContextHolder.clearContext();

		if (logger.isDebugEnabled()) {
			logger.debug("Authentication request failed: " + failed.toString(), failed);
			logger.debug("Updated SecurityContextHolder to contain null Authentication");
			logger.debug("Delegating to authentication failure handler " + failureHandler);
		}

		rememberMeServices.loginFail(request, response);

		failureHandler.onAuthenticationFailure(request, response, failed);
	}
protected void unsuccessfulAuthentication ( HttpServletRequest request , HttpServletResponse response , AuthenticationException failed ) throws IOException , ServletException { SecurityContextHolder . clearContext ( ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Authentication request failed: " + failed . toString ( ) , failed ) ; logger . debug ( "Updated SecurityContextHolder to contain null Authentication" ) ; logger . debug ( "Delegating to authentication failure handler " + failureHandler ) ; } rememberMeServices . loginFail ( request , response ) ; failureHandler . onAuthenticationFailure ( request , response , failed ) ; }
Default behaviour for unsuccessful authentication.
<ol>
<li>Clears the {@link SecurityContextHolder}</li>
<li>Stores the exception in the session (if it exists or
<tt>allowSesssionCreation</tt> is set to <tt>true</tt>)</li>
<li>Informs the configured <tt>RememberMeServices</tt> of the failed login</li>
<li>Delegates additional behaviour to the {@link AuthenticationFailureHandler}.</li>
</ol>
Default behaviour for unsuccessful authentication . <ol > <li > Clears the {