对于无效的发行人,预期出现 AuthenticationException,而不是 IllegalStateException

作者: gulecroc创建于 2026年1月7日更新于 2026年9月16日

标签status: waiting-for-feedbackin: oauth2status: feedback-reminder

Describe the bug Using oauth2 resource server with JWT authentication, if the client sends a token with an issuer different from the expected one, the exception thrown is IllegalStateException : https://GitHub.com/spring-projects/spring-security/blob/5fe6d9259fbee532d402a801527b7aed4d937e98/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtDecoderProviderConfigurationUtils.java#L99 The exception is never wrapped to AuthenticationException.

To Reproduce Configure oauth2 resource server and exception handling :

java

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http.csrf(AbstractHttpConfigurer::disable)
    .authorizeHttpRequests(matcher -> matcher.anyRequest().authenticated())
    .oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults()))
    .exceptionHandling(exceptionHandling -> exceptionHandling
      .authenticationEntryPoint(authenticationEntryPoint())
      .accessDeniedHandler(accessDeniedHandler()))
    .build();
}

@Bean
public AuthenticationEntryPoint authenticationEntryPoint() {
    return (HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) -> {
        LOGGER.error("Authentication failed", authException);
    };
}

@Bean
public AccessDeniedHandler accessDeniedHandler() {
    return (HttpServletRequest request, HttpServletResponse response,
            org.springframework.security.access.AccessDeniedException accessDeniedException) -> {
        LOGGER.error("Access denied", accessDeniedException);
    };
}

Configure JWT expected issuer uri :

yaml

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://issuer-uri

Send a request with an other issuer-uri : the exception is not logged

内容来源: spring-projects/spring-security

查看 GitHub 原文在 GitHub 查看讨论