REST service with Basic Authentication and transport access control

User_GQLGQ

We are trying to expose a service with basic authentication and transport access control configuration to allow users of a certain group. Version used: 12.2.1.3

If we expose the service as SOAP, set basic authentication and transport access configuration, and call the service with a user who is not in the configured group we obtain an HTTP error 403 Forbidden (as expected)

But, if we expose the service as REST with the same previous configuration, and call the service with a user who is not in the configured group we obtain an HTTP error 500 - Internal Server Error. This is an error that the client application can't properly understand

¿Is there any missing configuration?