Spring Security下抛ResponseStatusException返回401而非409的原因

场景复现 #

Spring Security配置 #

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
            .httpBasic(httpSecurityHttpBasicConfigurer -> httpSecurityHttpBasicConfigurer
                    .authenticationEntryPoint(restAuthenticationEntryPoint)
            ).csrf((csrf) -> csrf.disable()
            ).headers(httpSecurityHeadersConfigurer -> httpSecurityHeadersConfigurer.
                    frameOptions(frameOptionsConfig -> frameOptionsConfig.disable())
            ).authorizeHttpRequests((authz) -> authz
                    .requestMatchers(HttpMethod.POST, "/api/auth/user").permitAll()
                    .requestMatchers("/actuator/shutdown").permitAll()
                    .requestMatchers(toH2Console()).permitAll()
            ).sessionManagement(sessionManagement -> sessionManagement
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            );
    return http.build();
}

接口代码 #

@PostMapping("/api/auth/user")
public ResponseEntity createUser(@Valid @RequestBody User user) throws URISyntaxException {
    if (userRepository.findByUsernameIgnoreCase(user.getUsername()).isPresent()) {
        throw new ResponseStatusException(HttpStatus.CONFLICT);
        //return new ResponseEntity(HttpStatus.CONFLICT);
    }
    user.setPassword(passwordEncoder.encode(user.getPassword()));
    User createdUser = userRepository.save(user);
    return ResponseEntity.created(new URI("/api/auth/" + createdUser.getUsername()))
            .body(createdUser);
}

异常现象 #

当传入已存在的用户名时，抛出ResponseStatusException(HttpStatus.CONFLICT)本应返回409状态码，但实际返回401 Unauthorized；而使用return ResponseEntity(HttpStatus.CONFLICT)则能正常返回409。此外，当设置anyRequest().permitAll()时，抛出异常的方式也能正常返回409。

原因分析 #

核心问题出在Spring Security的ExceptionTranslationFilter与自定义restAuthenticationEntryPoint的交互逻辑上：

1. 默认授权规则的影响：你的Security配置中未显式设置anyRequest()规则，Spring Security 5.7+版本会默认将未匹配的请求设置为denyAll()。这种情况下，ExceptionTranslationFilter会处于严格的权限校验模式。
2. 异常拦截逻辑误触发：当在/api/auth/user（已配置permitAll的端点）抛出ResponseStatusException时，该异常会被ExceptionTranslationFilter捕获。由于该端点允许匿名访问，SecurityContext中没有认证用户，过滤器会错误地将这个业务异常关联到“未认证”场景，进而调用自定义的restAuthenticationEntryPoint返回401状态码。
3. anyRequest().permitAll()的作用：当显式设置该规则后，所有请求都允许匿名访问，ExceptionTranslationFilter会跳过对这类异常的额外干预，异常会被Spring MVC的默认异常处理器正常处理，返回预期的409状态码。

解决方法 #

方法1：显式配置剩余请求的授权规则 #

在authorizeHttpRequests中添加anyRequest().authenticated()，明确指定除三个permitAll端点外，其余请求需要认证。这样ExceptionTranslationFilter能清晰区分不同端点的权限规则，异常处理逻辑会恢复正常：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
            .httpBasic(httpSecurityHttpBasicConfigurer -> httpSecurityHttpBasicConfigurer
                    .authenticationEntryPoint(restAuthenticationEntryPoint)
            ).csrf((csrf) -> csrf.disable()
            ).headers(httpSecurityHeadersConfigurer -> httpSecurityHeadersConfigurer.
                    frameOptions(frameOptionsConfig -> frameOptionsConfig.disable())
            ).authorizeHttpRequests((authz) -> authz
                    .requestMatchers(HttpMethod.POST, "/api/auth/user").permitAll()
                    .requestMatchers("/actuator/shutdown").permitAll()
                    .requestMatchers(toH2Console()).permitAll()
                    .anyRequest().authenticated() // 显式配置其余请求需认证
            ).sessionManagement(sessionManagement -> sessionManagement
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            );
    return http.build();
}

方法2：配置Spring MVC全局异常处理器 #

通过@RestControllerAdvice定义全局异常处理器，直接捕获ResponseStatusException并返回对应状态码，绕过Security过滤器的异常拦截：

@RestControllerAdvice
public class GlobalExceptionHandler {
    @ExceptionHandler(ResponseStatusException.class)
    public ResponseEntity<Object> handleResponseStatusException(ResponseStatusException ex) {
        return ResponseEntity.status(ex.getStatusCode())
                .body(ex.getReason());
    }
}

内容的提问来源于stack exchange，提问作者IceMajor