Does Spring Security generate a 404 error on its own?

Spring Security itself does not generate a 404 (Not Found) error. Usually, a 404 occurs when a request does not match any registered route in the application. Spring Security is responsible for authentication and authorization, and in case of access issues, it is more likely to return a 401 (Unauthorized) or 403 (Forbidden). If you see a 404, it means that either the URL is not mapped to a controller, or security filters are configured in such a way that access is blocked but not redirected to an error page. Therefore, 404 is a result of routing and controllers, not directly Spring Security.