apacahe shiro ,after 1 successful basic authentication it returns true for all wrong credentials

I'm using Apache Shiro for my Rest service project and I have troubles getting it to work as intended.

For rest service,I use basic authentication and as first,when I send wrong username,It returns 401 as expected.

Then I send correct user name and password,It returns 200 as expected. As 3th step,When I send again wrong username,It returns 200,should return 401.

I think after first successful login,It doesnt need any authentication process again.How can I force it to authenticate for every request? I couldnt find any reason or any parameter I should add in my shiro.ini.

This is my shiro.ini:

What you are seeing may be the result of your client. Before a client will send credentials to a server typically has to ask for them (responding with a 401), the client will the add the auth header. A client can work around this using "preemptive" auth, which will send the Authorization header on the initial request.

Your server is likely also configured to use cookies, which the server will process first and then return a 200 (and the client would never send the new credentials).

If this is just a REST server/client setup, you could disable session creation, using the noSessionCreation filter.

https://shiro.apache.org/web.html#default_filters

If you are still stuck take a look at your HTTP logs and watch for the headers (specifically Authorization and an Cookie headers).