Spring Security OAuth2 更改 JSON 错误响应格式

Posted 2023-02-27

【中文标题】Spring Security OAuth2 更改 JSON 错误响应格式

【英文标题】：Spring Security OAuth2 Change JSON Error Response Format

【发布时间】：2016-04-04 10:41:40

【问题描述】：

我有一个基于 Spring Security OAuth2 的 RESTful 应用程序。我一直在尝试将默认的 Spring Security 消息格式从 XML 更改为 JSON，并且在这方面取得了部分成功。

例如-我想出了当请求不包含承载令牌时如何更改响应格式（以下行）

<bean id="oauthAuthenticationEntryPoint" class ="c.s.m.security.CustomAuthenticationEntryPoint" />

但我无法弄清楚如何捕捉/更改以下两项的格式。

当在安全 URL 中传递无效令牌时，Spring Security 当前会返回。在哪里更改此格式？

"error": "invalid_token","error_description": "Invalid access token: 144285e3-9563-420e-8ce"

如何更改 BadCredentialsException JSON 格式？目前返回一个类似上面的JSON？

下面是我的 applicationContext.xml

<sec:http pattern="/oauth/token" create-session="stateless"
    use-expressions="true" authentication-manager-ref="authenticationManager">
    <sec:csrf disabled="true" />
    <sec:anonymous enabled="false" />
    <sec:http-basic entry-point-ref="clientAuthenticationEntryPoint" />
    <sec:custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER" />
    <sec:access-denied-handler ref="oauthAccessDeniedHandler" />
</sec:http>
<sec:authentication-manager alias="authenticationManager"
    erase-credentials="false">
    <sec:authentication-provider user-service-ref="clientDetailsUserService" />
</sec:authentication-manager>

<bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
    <constructor-arg ref="clientDetails" />
</bean>

<!-- Entry point - Entry point Filter for token server -->

<bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <property name="realmName" value="Oauth 2 security" />
    <property name="typeName" value="Basic" />
</bean>

<bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <property name="authenticationManager" ref="authenticationManager" />
</bean>

<!-- Oauth handler Access Denied Handler -->

<bean id="oauthAccessDeniedHandler" class="c.s.m.security.CustomAccessDeniedHandler" />
    <!-- class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /> -->

<!-- Server resource -->

<sec:http pattern="/api/**" create-session="never"
    entry-point-ref="oauthAuthenticationEntryPoint" use-expressions="true" >
    <sec:csrf disabled="true" />
    <sec:anonymous enabled="false" />
    <sec:intercept-url pattern="/api/**" access="hasRole('ROLE_ADMIN')" />
    <sec:custom-filter ref="resourceServerFilter"
        before="PRE_AUTH_FILTER" />
    <sec:access-denied-handler ref="oauthAccessDeniedHandler" />
</sec:http>

<!-- Entry point resource -->

<bean id="oauthAuthenticationEntryPoint" class ="c.s.m.security.CustomAuthenticationEntryPoint" />          

<oauth:resource-server id="resourceServerFilter" resource-id="springsec" token-services-ref="tokenServices" />

<bean id="tokenServices"
    class="org.springframework.security.oauth2.provider.token.DefaultTokenServices" >
    <property name="tokenStore" ref="tokenStore" />
    <property name="supportRefreshToken" value="true" />
    <property name="accessTokenValiditySeconds" value="300000" />
    <property name="clientDetailsService" ref="clientDetails" />
</bean>    
<bean id="tokenStore"  class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
    <constructor-arg ref="dataSource" />
</bean>
<oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices">
    <oauth:authorization-code />
    <oauth:implicit />
    <oauth:refresh-token />
    <oauth:client-credentials />
    <oauth:password authentication-manager-ref="userAuthenticationManager" />
</oauth:authorization-server>

<sec:authentication-manager id="userAuthenticationManager">
    <sec:authentication-provider ref="customUserDetailsService" />
</sec:authentication-manager>

【问题讨论】：

How to force Spring Security OAuth 2 to use JSON instead of XML?的可能重复

【参考方案1】：

在请求头中发送Accept: application/json即可解决问题。