SpringBoot中抛出运行时异常会触发Access Denied异常

Question

我的 springboot 应用程序（用于博客）正在使用 JWT 身份验证方法。当用户尝试通过

pageId

查找存储库中不存在的博客时，我试图抛出

NoSuchElementException

在博客服务中：

    public BlogResponseDTO findBlogByPageId(String pageId) {
        BlogEntity blogEntity = blogRepository.findByPageId(pageId);
        if (blogEntity == null) {
            throw new NoSuchElementException("Blog not found for pageId: " + pageId);
        }
        return buildBlogResponseDTO(blogEntity);
    }

但它会抛出

401 Unauthorized

错误作为响应。

WebSecurityConfig：

//Imports
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.Http403ForbiddenEntryPoint;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.web.multipart.support.MultipartFilter;

import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {
    @Autowired
    private CustomUserDetailsService userDetailsService;

    @Autowired
    private JwtRequestFilter jwtRequestFilter;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests((auth) -> auth
                        .requestMatchers("/auth").permitAll()
                        .anyRequest().authenticated()
                )
                .csrf(AbstractHttpConfigurer::disable)
                .httpBasic(withDefaults())
                .userDetailsService(userDetailsService)
                .sessionManagement(sess -> sess.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .exceptionHandling(httpSecurityExceptionHandlingConfigurer -> {
                    httpSecurityExceptionHandlingConfigurer.authenticationEntryPoint((request, response, authException) -> {
                        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                        response.getWriter().write("Authentication failed: " + authException.getMessage());
                    });
                });
        http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
    

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }
}

即使我尝试显式抛出它，我的应用程序也不会抛出运行时错误。有人可以帮我解决我缺少的东西吗？如果您需要更多详细信息，请发表评论。

Answer 1

运行时异常由

/error

处理。根据我的

WebSecurityConfig

，这条路是不被允许的。

我添加了

.requestMatchers("/auth", "/error").permitAll()

到过滤器链，现在工作正常。