Authentication 验证失败时Apache Shiro中的预期响应？

我在每个请求中使用客户端id和头中的访问令牌实现了承载令牌身份验证

当我使用错误的凭证访问令牌时，我返回一个200 OK的空正文，这是预期的吗？是401还是404？当我使用正确的凭证时，我得到了预期的Json响应，以及正文内容

我正在使用DefaultPasswordService和AuthorizationRealm。也许我错过了什么

---

使用Shiro 1.2.3，我想我解决了这个问题

在我的onAccessDenied看起来像这样之前：

@Override 
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) 
        throws Exception {       
    if (hasAuthorizationToken(request)) { 
        // Proceed with authentication 
        return executeLogin(request, response);           
    } 
    // Return 401 if authentication failed 
          WebUtils.toHttp(response).sendError( 
                Status.UNAUTHORIZED.getStatusCode(), 
                "Oops, Authentication required"); 
    return false; 
} 

@Override  
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) 
            throws Exception { 
        boolean authenticated = false; 
        if (hasAuthorizationToken(request)) { 
            // Proceed with authentication 
            authenticated = executeLogin(request, response);           
        } 
        // Return 401 if authentication failed 
        if (!authenticated) 
            WebUtils.toHttp(response).sendError( 
                    Status.UNAUTHORIZED.getStatusCode(), 
                    "Oops, Authentication required"); 
        return authenticated;  
}

现在看起来是这样的：

@Override 
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) 
        throws Exception {       
    if (hasAuthorizationToken(request)) { 
        // Proceed with authentication 
        return executeLogin(request, response);           
    } 
    // Return 401 if authentication failed 
          WebUtils.toHttp(response).sendError( 
                Status.UNAUTHORIZED.getStatusCode(), 
                "Oops, Authentication required"); 
    return false; 
} 

@Override  
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) 
            throws Exception { 
        boolean authenticated = false; 
        if (hasAuthorizationToken(request)) { 
            // Proceed with authentication 
            authenticated = executeLogin(request, response);           
        } 
        // Return 401 if authentication failed 
        if (!authenticated) 
            WebUtils.toHttp(response).sendError( 
                    Status.UNAUTHORIZED.getStatusCode(), 
                    "Oops, Authentication required"); 
        return authenticated;  
}

身份验证失败时，我需要手动返回Status.UNAUTHORIZED