.../tests/modules/rest_test/rest_test.services.yml |  5 ++++
 .../src/Authentication/Provider/TestAuth.php       | 27 ++++++++++++++++++++++
 .../EntityResource/EntityResourceTestBase.php      | 10 ++++++++
 3 files changed, 42 insertions(+)

diff --git a/core/modules/rest/tests/modules/rest_test/rest_test.services.yml b/core/modules/rest/tests/modules/rest_test/rest_test.services.yml
new file mode 100644
index 0000000..4bbecd0
--- /dev/null
+++ b/core/modules/rest/tests/modules/rest_test/rest_test.services.yml
@@ -0,0 +1,5 @@
+services:
+  rest_test.authentication.test_auth:
+    class: Drupal\rest_test\Authentication\Provider\TestAuth
+    tags:
+      - { name: authentication_provider, provider_id: 'rest_test_auth' }
\ No newline at end of file
diff --git a/core/modules/rest/tests/modules/rest_test/src/Authentication/Provider/TestAuth.php b/core/modules/rest/tests/modules/rest_test/src/Authentication/Provider/TestAuth.php
new file mode 100644
index 0000000..36302ac
--- /dev/null
+++ b/core/modules/rest/tests/modules/rest_test/src/Authentication/Provider/TestAuth.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Drupal\rest_test\Authentication\Provider;
+
+use Drupal\Core\Authentication\AuthenticationProviderInterface;
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * Authentication provider for testing purposes.
+ */
+class TestAuth implements AuthenticationProviderInterface {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function applies(Request $request) {
+    return $request->headers->has('REST-test-auth');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function authenticate(Request $request) {
+    return NULL;
+  }
+
+}
diff --git a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
index 37dcb9e..cde91b3 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
@@ -335,6 +335,16 @@ public function testGet() {
       $this->assertResponseWhenMissingAuthentication($response);
     }
 
+
+    $request_options[RequestOptions::HEADERS]['REST-test-auth'] = '1';
+
+
+    // DX: 403 when attempting to use unallowed authentication provider.
+    $response = $this->request('GET', $url, $request_options);
+    $this->assertResourceErrorResponse(403, 'The used authentication method is not allowed on this route.', $response);
+
+
+    unset($request_options[RequestOptions::HEADERS]['REST-test-auth']);
     $request_options = NestedArray::mergeDeep($request_options, $this->getAuthenticationRequestOptions('GET'));