Spring Boot Security JWT 自定义身份验证错误消息

Question

How to send different error messages on JWT authentication failure? I tried below code, its always sending message as: Full authentication is required to access this resource instead I want to use errorMessage from exception. I am using spring boot 3 (if it matters)

WebSecurityConfig.class:

 @Bean
public AuthenticationEntryPoint restAuthenticationEntryPoint() {
    return (request, response, error) -> {
        log.info("restAuthenticationEntryPoint: {}", error.getMessage(), error);
        Map<String, Object> errorObject = new HashMap<>();
        int errorCode = 401;
        errorObject.put("message", error.getMessage());
        errorObject.put("error", HttpStatus.UNAUTHORIZED);
        errorObject.put("code", errorCode);
        errorObject.put("timestamp", new Timestamp(new Date().getTime()));
        response.setContentType("application/json;charset=UTF-8");
        response.setStatus(errorCode);
        response.getWriter().write(objectMapper.writeValueAsString(errorObject));
    };
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
            .csrf()
            .disable()
            .formLogin()
            .disable()
            .httpBasic()
            .disable()
            .exceptionHandling()
            .authenticationEntryPoint(restAuthenticationEntryPoint())
            .and()
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .addFilterBefore(tokenAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
 
    return http.build();
}

At JWT validation, I am throwing different messages, still client is receiving same error message.

 public DecodedJWT decodeJWT(String authToken) {
    try {
        return verifier.verify(authToken));
    } catch (SignatureVerificationException e) {
        log.error("Invalid JWT signature: {}", e.getMessage());
        throw new TokenException(e.getMessage());
    } catch (TokenExpiredException e) {
        log.error("JWT token is expired: {}", e.getMessage());
        throw new TokenException(e.getMessage());
    } catch (MissingClaimException e) {
        log.error("JWT token is unsupported: {}", e.getMessage());
        throw new TokenException(e.getMessage());
    } catch (JWTDecodeException e) {
        log.error("JWT claims string is empty: {}", e.getMessage());
        throw new TokenException(e.getMessage());
    } catch (AlgorithmMismatchException | IncorrectClaimException e) {
        log.error("JWT alg mismatch or incorrect claim : {}", e.getMessage());
        throw new TokenException(e.getMessage());
    } catch (InvalidClaimException e) {
        log.error("InvalidClaimException");
        throw new TokenException(e.getMessage());
    } catch (JWTVerificationException e) {
        log.error("JWTVerificationException at end");
        throw new TokenException(e.getMessage());
    }
}

TokenException class:

public class TokenException extends AuthenticationException {
 public TokenException(String msg, Throwable cause) {
    super(msg, cause);
 }

 public TokenException(String msg) {
    super(msg);
 }
}

Answer 1

This exception throws from tokenAuthenticationFilter class. Note that the filter class won't stop even if an exception occurs. Your filter class will just ignore your exception.

How to stop when exception occurs? When you're calling decodeJwt(); method. You should put this method inside try-catch. If exception is catched then you should call sendError(); method from HttpServletResponse class and put return; method.

Add return; even method is void

DecodedJWT decodedJWT = null;
try {
  decodedJWT = jwtUtils.decodeJWT(token);
} catch(Exception e) {
  response.sendError(401, e.getMessage);
  return;
}

add this code above to your filter class