我在API Rest JWT身份验证中实现了,但我创建的异常不起作用.

这就是我所期望的:

"timestamp": "2022-06-02T21:56:28.372+00:00",
"error": "BAD_REQUEST",
"message": "Invalid JWT signature",

这就是我得到的:

"timestamp": "2022-06-02T22:12:25.698+00:00",
"status": 500,
"error": "Internal Server Error",
"trace": "com.onlinestore.app.exceptions.OnlineStoreAPIException\r\n\tat com.onlinestore.app.security.JwtTokenProvider.validateToken(JwtTokenProvider.java:54)\r\n\tat com.onlinestore.app.security.JwtAuthenticationFilter.doFilterInternal(JwtAuthenticationFilter.java:36)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103)\r\n\tat org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90)\r\n\tat org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110)\r\n\tat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)\r\n\tat org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211)\r\n\tat org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183)\r\n\tat org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354)\r\n\tat org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\r\n\tat org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\r\n\tat org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\r\n\tat org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)\r\n\tat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\r\n\tat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)\r\n\tat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)\r\n\tat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)\r\n\tat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)\r\n\tat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\r\n\tat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)\r\n\tat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)\r\n\tat org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)\r\n\tat org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\r\n\tat org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890)\r\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743)\r\n\tat org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\r\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)\r\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)\r\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\r\n\tat java.base/java.lang.Thread.run(Thread.java:833)\r\n",
"message": "No message available",
"path": "/api/v1/placeorder"

这是我的CustomException类

public class OnlineStoreAPIException  extends RuntimeException{

     private HttpStatus status;
     private String message;

     public OnlineStoreAPIException(HttpStatus status, String message) {
         this.status = status;
         this.message = message;
     }

     public OnlineStoreAPIException(String message, HttpStatus status, String message1){
         super(message);
         this.status = status;
         this.message = message1;
     }

     public HttpStatus getStatus() {
         return status;
     }

    @Override
    public String getMessage() {
         return message;
    }
}

这就是我的globalExceptionHandler

 @ControllerAdvice
 public class globalExceptionHandler extends ResponseEntityExceptionHandler {

 @ExceptionHandler(OnlineStoreAPIException.class)
 public ResponseEntity<ErrorDetails> 
 handlerOnlineStoreAPIException(OnlineStoreAPIException ex , WebRequest webRequest){

    ErrorDetails errorDetails = new ErrorDetails(new Date(), ex.getMessage(), 
                                webRequest.getDescription(false));

    return new ResponseEntity<ErrorDetails>(errorDetails, HttpStatus.BAD_REQUEST);

}

最后,这是我在JwtTokenProvider中的validateToken方法中所拥有的内容:

公共布尔validateToken字符串标记){

    try{
        Jwts.parser().setSigningKey(jwtSecret).parseClaimsJws(token);
        return true;
    }catch (SignatureException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Invalid JWT signature");
    }
    catch (MalformedJwtException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Invalid JWT token");
    }
    catch (ExpiredJwtException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Expired JWT token");
    }
    catch (UnsupportedJwtException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Unsupported JWT token");
    }
    catch (IllegalArgumentException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "JWT claims string is empty");
    }
}

如果有人能帮忙,我真的很感激.

推荐答案

这是因为Spring过滤器具有不同的错误响应机制,与一般异常不同.在this sample of mine中,我使用一个自定义过滤器来完成OAuth工作.

更标准的弹簧选项是定制AccessDeniedHandler,如this tutorial中所述.

http.authorizeRequests()
        // other configurations
     .and().oauth2ResourceServer()
     .authenticationEntryPoint(new CustomOAuth2AuthenticationEntryPoint())
        .accessDeniedHandler(new CustomOAuth2AccessDeniedHandler();

Java相关问答推荐

使用ExecutorService时在ThreadFactory中触发自定义newThread函数

Java JAR环境(JRE)是否支持模块?

Springdoc Whitelabel Error Page with Spring V3

如何配置ActiveMQ Artemis以使用AMQP 1.0和其他协议与Java

JVM会优化这个数学运算吗?

如何才能使我的程序不会要求两次输入?

为什么不应用类型推断?

放气总是压缩整个街区吗?

如何让JVM在SIGSEGV崩溃后快速退出?

类型集合的Jackson JsonNode:类型引用的对象读取器应该是Singleton吗?

在添加AdMob时无法为Google Play构建应用程序包:JVM垃圾收集器崩溃和JVM内存耗尽

如何用内置Java从JavaFX应用程序中生成.exe文件?

我如何为我的Java抵押贷款代码执行加薪操作(&Q)

无法使用Java PreparedStatement在SQLite中的日期之间获取结果

AWS Java SDK v2.x中没有setObjectAcl方法

使用MediaPlayer类在一段时间后停止播放音乐

Java 21内置http客户端固定运营商线程

转换为JSON字符串时,日期按天递减-Java

在外部类和内部类之间,当调用外部类内部或外部的主方法时,它们的静态初始化程序的运行顺序不同

一条Java记录可以保存多少个字段?