How to customize the authentication failure error to return a message in Body from the reply?

Question

When an authentication failure occurs in Spring Security, it returns an error in the response header. I would like to customize the error and return a message in the reply Body.

Below is the code used to validate Oauth2 with Spring Security Webflux with Opaque Token

@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class SecurityConfig {

    @Value("${spring.security.oauth2.resourceserver.opaque-token.introspection-uri}")
    private String introspectUri;
    @Value("${spring.security.oauth2.resourceserver.opaque-token.client-id}")
    private String clientId;
    @Value("${spring.security.oauth2.resourceserver.opaque-token.client-secret}")
    private String clientSecret;

    @Bean
    SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http.csrf().disable()
                .formLogin().disable()
                .httpBasic().disable()
                .authorizeExchange()
                .pathMatchers(HttpMethod.OPTIONS).permitAll()
                .pathMatchers("/**").hasRole("read")
                .anyExchange().denyAll()
                .and()
                .oauth2ResourceServer(ServerHttpSecurity.OAuth2ResourceServerSpec::opaqueToken);
        return http.build();
    }

    @Bean
    public ReactiveOpaqueTokenIntrospector introspector() {
        return new JwtOpaqueTokenIntrospector(this.introspectUri, this.clientId, this.clientSecret);
    }
}

Current response:

Response I wish to return

{
    "developerMessage": "Unauthorized - make sure the header parameter Authorization is valid",
    "userMessage": "You are not authorized to perform this operation",
    "errorCode": 30001,
    "moreInfo": ""
}

Answer 1

The most "Spring" way to do this is to use a @RestControllerAdvice to intercept errors and change the error response to the format you want.

In the case of Spring, when it returns error 401, it will probably return the exception AccessDeniedException to signal this. So you can intercept it and exchange it for the answer you would like.

It would be something like that:

@Slf4j
@RestControllerAdvice
public class ErrorHandlerController {

    @ExceptionHandler(AccessDeniedException.class)
    public ResponseEntity<ApiErrorResponse> handleThrowable(AccessDeniedException ex, Locale locale) {
        log.error("Acesso não autorizado na API", ex);
        ApiErrorResponse error = new ApiErrorResponse("Unauthorized - make sure the header parameter Authorization is valid", "You are not authorized to perform this operation", 3001);
        return new ResponseEntity<>(error, HttpStatus.UNAUTHORIZED);
    }

}

The class ApiErrorResponse is the class with developerMessage, userMessage, errorCode and moreInfo.