Spring：REST 异常被捕获为 403 Forbidden 异常答案

【问题标题】：Spring: REST exceptions are caught as 403 Forbidden exceptionSpring：REST 异常被捕获为 403 Forbidden 异常
【发布时间】：2023-01-26 00:51:17
【问题描述】：

我创建了一个带有自定义 JWT 身份验证的 Spring Boot Rest Api（有一天我会使用 Keycloak 进行更改）。

自定义过滤器是这样的：

public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtService jwtService;

    private final UserDetailsService userDetailsService;

    @Override
    protected void doFilterInternal(
            @NonNull HttpServletRequest request,
            @NonNull HttpServletResponse response,
            @NonNull FilterChain filterChain
    ) throws ServletException, IOException {
        final String authHeader = request.getHeader("Authorization");
        final String jwt;
        final String userEmail;
        if(authHeader == null || !authHeader.startsWith("Bearer ")){
            filterChain.doFilter(request, response);
            return;
        }
        // Extract token
        jwt = authHeader.substring(7);
        // Extract username or email from JWT token
        userEmail = jwtService.extractUsername(jwt);
        if(userEmail != null && SecurityContextHolder.getContext().getAuthentication() == null){
            UserDetails userDetails = this.userDetailsService.loadUserByUsername(userEmail);
            if(jwtService.isTokenValid(jwt, userDetails)){
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                        userDetails,
                        null,
                        userDetails.getAuthorities()
                );
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        filterChain.doFilter(request, response);
    }
}

安全配置：

public class SecurityConfiguration {

    private final JwtAuthenticationFilter jwtAuthFilter;
    private final AuthenticationProvider authenticationProvider;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception{
        
        httpSecurity
                .csrf()
                .disable()
                .authorizeHttpRequests()
                .requestMatchers("/api/v1/auth/**")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .authenticationProvider(authenticationProvider)
                .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
        
        return httpSecurity.build();
    }
    
}

问题是，当我在运行时遇到任何异常（IllegalArgumentException、RuntimeException 等）时，所有异常都会作为“403 Forbidden”返回给调用者。我想将实际异常返回给调用者。

我在这里错过了什么？

【问题讨论】：

您的安全配置在哪里？
@Unmitigated 添加到问题中，抱歉

标签： java spring exception

【解决方案1】：

您需要允许访问/error。

.requestMatchers("/api/v1/auth/**", "/error").permitAll()

【讨论】：