.../EntityResource/EntityResourceTestBase.php       | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
index 12b08e3..aa2b3ca 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
@@ -125,15 +125,6 @@ public function testGet() {
 
 
     $this->provisionEntityResource();
-
-
-    // DX: 403 when unauthorized.
-    $response = $this->request('GET', $url, $request_options);
-    // @todo Update this to the improved error message when https://www.drupal.org/node/2808233 lands.
-    $this->assertResourceErrorResponse(403, '', $response);
-
-
-    $this->setUpAuthorization('GET');
     // Simulate the developer again forgetting the ?_format query string.
     $url->setOption('query', []);
 
@@ -143,7 +134,7 @@ public function testGet() {
     // route.
     $response = $this->request('GET', $url, $request_options);
     if ($has_canonical_url && !static::$auth) {
-      $this->assertSame(200, $response->getStatusCode());
+      $this->assertSame(403, $response->getStatusCode());
     }
     else {
       $this->assert406Response($response);
@@ -160,10 +151,18 @@ public function testGet() {
       $this->verifyResponseWhenMissingAuthentication($response);
     }
 
-
     $request_options = array_merge_recursive($request_options, $this->getAuthenticationRequestOptions());
 
 
+    // DX: 403 when unauthorized.
+    $response = $this->request('GET', $url, $request_options);
+    // @todo Update this to the improved error message when https://www.drupal.org/node/2808233 lands.
+    $this->assertResourceErrorResponse(403, '', $response);
+
+
+    $this->setUpAuthorization('GET');
+
+
     // 200 for well-formed HEAD request.
     $response = $this->request('HEAD', $url, $request_options);
     $this->assertResourceResponse(200, '', $response);