Spring Security Oauth2：访问令牌无效/过期时的回退

Question

I am using Spring Security to protect my endpoints.

My problem is, is it possible to response differently when users are using valid/invalid access token?

For example, for a single /api/info

(1) When an invalid/expired access token is passed in the request, only very limited information will be returned
(2) When a valid access token is passed in the request, very customized and rich content is returned according to a different user.

I've tried to use access=permitAll() , but it doesn't work because invalid tokens can not pass oauth2 validation.

Using security="none" is also not working because it will not try to get user info at all.

Answer 1

编写一个自定义的OAuth2AccessDeniedHandler ，然后使用security:access-denied-handler XML标记或类似的Java Config将其插入到/info端点。