Spring Boot Custom Exception showing most peculiar Behavior - spring

Question

Note - I have already set the flag server.error.include-message=always in application.properties
I have made a custom exception which should give a message to client when raised. However, that does not seem to be working whenever error code is 401/403. In that case I only receive a 401/403 status code with no response body at all, like below.
As soon as I change the status code to anything else, I start getting proper response body, like this.
BadCredentialsException.java
#ResponseStatus(value = HttpStatus.UNAUTHORIZED)
public class BadCredentialsException extends RuntimeException{
// Runtime exception just needs this, I guess :/
private static final long serialVersionUID = 1;
public BadCredentialsException(String message){
super(message);
}
}
See First antMatchers, that's where the concerned endpoint is.
SecurityConfiguration.java
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable().
authorizeRequests().
antMatchers(HttpMethod.POST, "/api/v2/user/login/**").permitAll().
antMatchers(HttpMethod.POST, "/api/v2/user/", "/api/v2/user", "/api/v2/user/change-role/**").hasAuthority("ROOT").
antMatchers(HttpMethod.GET, "/api/v2/user/", "/api/v2/user").hasAuthority("ROOT").
antMatchers(HttpMethod.POST, "/api/v1/customers/", "/api/v1/customers").hasAnyAuthority("ADMIN", "ROOT").
antMatchers(HttpMethod.GET, "/api/v1/customers/", "/api/v1/customers").hasAnyAuthority("EMPLOYEE", "ADMIN", "ROOT").
anyRequest().
authenticated().
and().
httpBasic();
}
My Thoughts and Observations
-> I can see my message in the terminal, that means the exception is definitely being raised. I have also tried logging something out in the BadCredentialsException file to see if its being raised or not, and yes it seems to be working.
-> There is a possibility that spring security might be deleting the response body on such status codes, although that's only a wild guess. I am going to try and disable spring security for a bit and see if I receive proper response body or not.
UPDATE - I have modified the post so that only currently relevant questions are being shown.

Answer 1

I'm not sure if I understood your post correctly.
But anyways, I advice you to use CURL or other http testing tool such as SoapUi to test the authentication.
Because I guess Postman caches the Cookies returned by the request.
A correct authentication attempt returns the header "Set-Cookie: JSESSIONID=SESSION ID".
Postman sends that cookie in the next requests, thats why the authentication still works after you change the password.
Only if you change the username the cookie is not sent.
Using CURL or SoapUi will prevent that from happen.
Regarding the body being returned or not, I guess the only way to control the response body using spring security is customizing the BasicAuthenticationEntryPoint.