Custom Exceptions for JWT authentication don't work JAVa-CodePudding

I implemented in my API Rest JWT authentication, but the exceptions that I created don't work.

This is what I expect:

"timestamp": "2022-06-02T21:56:28.372 00:00",
"error": "BAD_REQUEST",
"message": "Invalid JWT signature",

This is what I get:

"timestamp": "2022-06-02T22:12:25.698 00:00",
"status": 500,
"error": "Internal Server Error",
"trace": "com.onlinestore.app.exceptions.OnlineStoreAPIException\r\n\tat com.onlinestore.app.security.JwtTokenProvider.validateToken(JwtTokenProvider.java:54)\r\n\tat com.onlinestore.app.security.JwtAuthenticationFilter.doFilterInternal(JwtAuthenticationFilter.java:36)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103)\r\n\tat org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90)\r\n\tat org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110)\r\n\tat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211)\r\n\tat org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183)\r\n\tat org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354)\r\n\tat org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\r\n\tat org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\r\n\tat org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\r\n\tat org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\r\n\tat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)\r\n\tat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)\r\n\tat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)\r\n\tat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)\r\n\tat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\r\n\tat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)\r\n\tat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)\r\n\tat org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)\r\n\tat org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\r\n\tat org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890)\r\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743)\r\n\tat org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\r\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)\r\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)\r\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\r\n\tat java.base/java.lang.Thread.run(Thread.java:833)\r\n",
"message": "No message available",
"path": "/api/v1/placeorder"

This is my CustomException Class

public class OnlineStoreAPIException  extends RuntimeException{

     private HttpStatus status;
     private String message;

     public OnlineStoreAPIException(HttpStatus status, String message) {
         this.status = status;
         this.message = message;
     }

     public OnlineStoreAPIException(String message, HttpStatus status, String message1){
         super(message);
         this.status = status;
         this.message = message1;
     }

     public HttpStatus getStatus() {
         return status;
     }

    @Override
    public String getMessage() {
         return message;
    }
}

This is what I have in my globalExceptionHandler

 @ControllerAdvice
 public class globalExceptionHandler extends ResponseEntityExceptionHandler {

 @ExceptionHandler(OnlineStoreAPIException.class)
 public ResponseEntity<ErrorDetails> 
 handlerOnlineStoreAPIException(OnlineStoreAPIException ex , WebRequest webRequest){

    ErrorDetails errorDetails = new ErrorDetails(new Date(), ex.getMessage(), 
                                webRequest.getDescription(false));

    return new ResponseEntity<ErrorDetails>(errorDetails, HttpStatus.BAD_REQUEST);

}

And finally this is what I have in the method validateToken in JwtTokenProvider:

public boolean validateToken(String token){

    try{
        Jwts.parser().setSigningKey(jwtSecret).parseClaimsJws(token);
        return true;
    }catch (SignatureException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Invalid JWT signature");
    }
    catch (MalformedJwtException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Invalid JWT token");
    }
    catch (ExpiredJwtException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Expired JWT token");
    }
    catch (UnsupportedJwtException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Unsupported JWT token");
    }
    catch (IllegalArgumentException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "JWT claims string is empty");
    }
}

I really appreciate if someone can give a hand.

CodePudding user response：

This is because Spring filters have a different error response mechanism, separate to general exceptions. In this sample of mine I am using a custom filter to do the OAuth work.

The more standard Spring option is to customize the AccessDeniedHandler as discussed in this tutorial.

http.authorizeRequests()
        // other configurations
     .and().oauth2ResourceServer()
     .authenticationEntryPoint(new CustomOAuth2AuthenticationEntryPoint())
        .accessDeniedHandler(new CustomOAuth2AccessDeniedHandler();

CodePudding user response：

I solved the error by adding the exceptions in the JWTAuthenticationFilter instead in JwtTokenProvider:

@Override
protected void doFilterInternal(HttpServletRequest request,
                                HttpServletResponse response,
                                FilterChain filterChain) throws ServletException, IOException {
    try {
        //get JWT from http request
        String token = getToken(request);

        //validate token
        if (StringUtils.hasText(token) && jwtTokenProvider.validateToken(token)) {

            //get username from token
            String username = jwtTokenProvider.getUsernameByToken(token);

            //Load User associated with token
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);

            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
            authenticationToken.setDetails((new WebAuthenticationDetailsSource().buildDetails(request)));

            SecurityContextHolder.getContext().setAuthentication(authenticationToken);


        }
        filterChain.doFilter(request, response);

    }catch (SignatureException ex){
        response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid JWT signature");

    }
    catch (MalformedJwtException ex){
        response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid JWT token");

    }
    catch (ExpiredJwtException ex){
        response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_BAD_REQUEST, "Expired JWT token");

    }
    catch (UnsupportedJwtException ex){
        response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_BAD_REQUEST, "Unsupported JWT token");

    }
    catch (IllegalArgumentException ex){
        response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_BAD_REQUEST, "JWT claims string is empty");
        
    }
}