You set a breakpoint inside a Spring MVC controller, or a service, send the request to an HTTP endpoint, and nothing happens. The response is back - and it is a 403 (or 401, or a redirect to a login page).
At that point, the bug you were trying to catch is no longer the only problem. Now, you nee…