Spring Security中如何处理ClientSecretAuthenticationProvider抛出的OAuth2AuthenticationException？

OAuth2AuthorizationServerConfigurer authorizationServerConfigurer = new OAuth2AuthorizationServerConfigurer();
authorizationServerConfigurer.tokenEndpoint(tokenEndpoint ->
((OAuth2TokenEndpointConfigurer)tokenEndpoint).errorResponseHandler(new RestExceptionTranslationFilter())
);
...
http.exceptionHandling(exceptions ->
exceptions.authenticationEntryPoint(new RestAuthenticationEntryPoint()));
}

目前我可以处理`OAuth2AuthenticationException`及其他异常，返回符合需求的响应，例如以下异常可被正确处理：

```java
org.springframework.security.oauth2.core.OAuth2AuthenticationException: OAuth 2.0 Parameter: grant_type
    at org.springframework.security.oauth2.server.authorization.web.OAuth2TokenEndpointFilter.throwError(OAuth2TokenEndpointFilter.java:260) ~[spring-security-oauth2-authorization-server-1.0.0.jar:1.0.0]
    at org.springframework.security.oauth2.server.authorization.web.OAuth2TokenEndpointFilter.doFilterInternal(OAuth2TokenEndpointFilter.java:159) ~[spring-security-oauth2-authorization-server-1.0.0.jar:1.0.0]

但令我困惑的是，同样是OAuth2AuthenticationException，当由ClientSecretAuthenticationProvider抛出时（如下所示），却无法被当前配置处理：

org.springframework.security.oauth2.core.OAuth2AuthenticationException: Client authentication failed: client_id
    at org.springframework.security.oauth2.server.authorization.authentication.ClientSecretAuthenticationProvider.throwInvalidClient(ClientSecretAuthenticationProvider.java:151) ~[spring-security-oauth2-authorization-server-1.0.0.jar:1.0.0]
    at org.springframework.security.oauth2.server.authorization.authentication.ClientSecretAuthenticationProvider.authenticate(ClientSecretAuthenticationProvider.java:99) ~[spring-security-oauth2-authorization-server-1.0.0.jar:1.0.0]

请问是否可以处理该异常？如何实现？我希望避免向攻击者暴露"error": "invalid_client"这类信息。

解决方案 #

问题原因 #

你当前配置的errorResponseHandler仅处理TokenEndpoint内的异常（如grant_type参数错误），而ClientSecretAuthenticationProvider抛出的异常属于客户端认证阶段的异常，由OAuth2ClientAuthenticationFilter负责处理，该过滤器并未关联你的自定义异常处理器，因此无法捕获这类异常。

具体实现步骤 #

1. 扩展客户端认证的异常处理配置
   在你的SecurityFilterChain配置中，给客户端认证流程添加自定义的AuthenticationFailureHandler，修改后的配置如下：

public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
    // ... 原有其他配置
    OAuth2AuthorizationServerConfigurer authorizationServerConfigurer = new OAuth2AuthorizationServerConfigurer();
    
    // 保留原有TokenEndpoint错误处理器配置
    authorizationServerConfigurer.tokenEndpoint(tokenEndpoint ->
        tokenEndpoint.errorResponseHandler(new RestExceptionTranslationFilter())
    );
    
    // 新增：配置客户端认证的失败处理器
    authorizationServerConfigurer.clientAuthentication(clientAuth ->
        clientAuth.authenticationFailureHandler(new RestExceptionTranslationFilter())
    );
    
    // 保留原有异常入口配置
    http.exceptionHandling(exceptions ->
        exceptions.authenticationEntryPoint(new RestAuthenticationEntryPoint())
    );
    
    // 将Authorization Server配置应用到HttpSecurity
    http.apply(authorizationServerConfigurer);
    
    // ... 其他配置
    return http.build();
}

2. 在自定义处理器中替换敏感错误信息
   在RestExceptionTranslationFilter的onAuthenticationFailure方法中，识别OAuth2AuthenticationException并替换默认的敏感错误内容：

@Override
public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
    if (exception instanceof OAuth2AuthenticationException oAuth2Exception) {
        // 统一替换敏感错误码和描述，避免暴露具体问题
        Map<String, Object> customResponse = new HashMap<>();
        customResponse.put("error", "authentication_failed");
        customResponse.put("error_description", "客户端认证失败，请检查认证信息");
        
        // 设置响应状态和格式
        response.setStatus(HttpStatus.UNAUTHORIZED.value());
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        new ObjectMapper().writeValue(response.getWriter(), customResponse);
    } else {
        // 处理其他类型的认证异常
        response.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        response.getWriter().write("{\"error\": \"server_error\", \"error_description\": \"服务器内部错误\"}");
    }
}

3. 补充入口异常处理（可选）
   如果需要处理未携带客户端认证信息的场景，可以在RestAuthenticationEntryPoint的commence方法中返回同样风格的自定义响应，确保异常处理的一致性。

内容的提问来源于stack exchange，提问作者dplesa