【Spring Security】使用 postman 請求一個有 spring security 保護的 api，登入失敗回傳 401 狀態碼 ，但使用前端後分離的 vue 請求同樣的api，卻是回傳 302 狀態碼

import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.stereotype.Component;

import java.io.IOException;

@Component
public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        response.setStatus(HttpStatus.UNAUTHORIZED.value()); // 回傳 401 狀態碼
        response.getWriter().write("Unauthorized");
    }
}

@Autowired
private CustomAuthenticationEntryPoint customAuthenticationEntryPoint;

@Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        return http
                // 設定 Session 的創建實例, 使用 http basic 認證時，創造 Session 和 Cookie
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.ALWAYS))
                .csrf(csrf -> csrf.disable())
                .httpBasic(Customizer.withDefaults())
                .formLogin(Customizer.withDefaults())
                .authorizeHttpRequests(request -> request
                        // 註冊功能
                        .requestMatchers("/", "/register").permitAll()
                        .requestMatchers("/memberLogin").authenticated()
                        // 權限
                        .requestMatchers("/hello").hasRole("ADMIN")
                        .requestMatchers("/helloWorld").hasRole("NORMAL_MEMBER")
                        .anyRequest().denyAll() // deny-by-default
                )
                .exceptionHandling(exceptionHandling ->
                                exceptionHandling
                                .authenticationEntryPoint(customAuthenticationEntryPoint)
                )
                .formLogin(formLogin ->
                        formLogin
                                .loginPage("/login")
                                .permitAll()
                )
                .logout(logout ->
                        logout
                                .permitAll()
                )
                .cors(Customizer.withDefaults()) // disable this line to reproduce the CORS 401
                .build();
    }