Spring boot unauthorized response with XMLHttpRequest - spring

Question

I have spring boot + spring security application and I discovered strange behavior. When I send request with wrong authorization (basic), I receive normal error message in body:
{
"timestamp": "2018-01-15T11:59:31.837+0000",
"status": 401,
"error": "Unauthorized",
"message": "Bad credentials",
"path": "/karbonator/api/v1/wallet"
}
But if I put X-Requested-With: XMLHttpRequest in header - I will receive only status 401 without body.
Is it normal? How can I fix it and receive error message in body with header XMLHttpRequest?
Spring boot version is 1.5.9.RELEASE
I do not use any custom header filters. Security configuration is simple:
SecurityBeanConfiguration
#Configuration
public class SecurityBeanConfiguration extends GlobalAuthenticationConfigurerAdapter {
#Autowired
private UserRepository userRepository;
#Override
public void init(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService());
}
#Bean
UserDetailsService userDetailsService() {
return new UserDetailsService() {
#Override
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
User user = userRepository.get(s);
if (Objects.nonNull(user)) {
return new org.springframework.security.core.userdetails.User(
user.getUsername(),
user.getPassword(),
true,
true,
true,
true,
AuthorityUtils.createAuthorityList(""));
} else {
throw new UsernameNotFoundException("Could not find the user " + s);
}
}
};
}
#Bean
public DaoAuthenticationProvider authenticationProvider() {
DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
provider.setUserDetailsService(userDetailsService());
return provider;
}
}
SecurityConfiguration
#Configuration
#EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
#Autowired
private DaoAuthenticationProvider authenticationProvider;
#Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.anyRequest().fullyAuthenticated()
.and().httpBasic()
.and().csrf().disable()
;
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(authenticationProvider);
}
}
All project available here: https://github.com/rublin/XMLHttpRequest
P.S. It looks like the Spring Security issue