Spring Boot Security V3.0.0：/guest/**端点异常被转401问题求助

问题场景 #

使用Spring Boot Starter Security V3.0.0配置OAuth2资源服务器时，/guest/**端点抛出的自定义异常（标记@ResponseStatus(HttpStatus.CONFLICT)）被强制转换为无响应体的HTTP 401状态码。无异常时请求可正常执行，但若将.requestMatchers("/guest/**").permitAll()替换为.requestMatchers("/**").permitAll()，异常可正常返回409，但此配置安全性极低。

当前SecurityFilterChain配置 #

@Bean
public SecurityFilterChain filterChain( final HttpSecurity http ) throws Exception {
    http
            .cors().and().csrf().disable()
            .sessionManagement().sessionCreationPolicy( SessionCreationPolicy.STATELESS )
            .and()
            .anonymous()
            .and()
            .authorizeHttpRequests()
            .requestMatchers( HttpMethod.OPTIONS ).permitAll()
            .requestMatchers( "/system/**" ).hasRole( new SecurityRole( Role.ROLE_SYSTEM ).toString() )
            .requestMatchers( "/admin/**" ).hasRole( new SecurityRole( Role.ROLE_AUTH_ADMIN ).toString() )
            .requestMatchers( "/identity/**" ).hasRole( new SecurityRole( Role.ROLE_AUTH_IDENTITY ).toString() )
            .requestMatchers( "/guest/**" ).permitAll()
            .anyRequest().authenticated()
            .and()
            .oauth2ResourceServer( OAuth2ResourceServerConfigurer::jwt );

    return http.build();
}

自定义异常类 #

@ResponseStatus( code = HttpStatus.CONFLICT )
public class HttpConflictException extends RuntimeException {
    public HttpConflictException( String message ) {
        super( message );
    }
}

依赖配置 #

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-resource-server</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-jose</artifactId>
</dependency>

问题原因 #

permitAll()仅解决了授权层面的访问允许，但OAuth2资源服务器的过滤器链会默认对所有进入的请求进行JWT令牌校验。当/guest/**请求未携带令牌时，过滤器会直接抛出401异常，且该异常的处理优先级高于Spring MVC的@ResponseStatus异常处理逻辑，导致自定义的409异常被覆盖。

解决方案 #

方案一：限定OAuth2资源服务器的作用路径 #

在oauth2ResourceServer配置中，通过securityMatcher指定仅对需要JWT校验的路径启用令牌校验：

@Bean
public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception {
    http
            .cors().and().csrf().disable()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .anonymous()
            .and()
            .authorizeHttpRequests(auth -> auth
                    .requestMatchers(HttpMethod.OPTIONS).permitAll()
                    .requestMatchers("/system/**").hasRole(new SecurityRole(Role.ROLE_SYSTEM).toString())
                    .requestMatchers("/admin/**").hasRole(new SecurityRole(Role.ROLE_AUTH_ADMIN).toString())
                    .requestMatchers("/identity/**").hasRole(new SecurityRole(Role.ROLE_AUTH_IDENTITY).toString())
                    .requestMatchers("/guest/**").permitAll()
                    .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                    .securityMatcher("/system/**", "/admin/**", "/identity/**")
                    .jwt(Customizer.withDefaults())
            );

    return http.build();
}

方案二：配置多SecurityFilterChain #

通过多个SecurityFilterChain Bean，为不同路径组配置独立的安全规则，彻底隔离需要JWT校验和不需要校验的路径：

// 配置需要JWT校验的路径
@Bean
@Order(1)
public SecurityFilterChain protectedFilterChain(HttpSecurity http) throws Exception {
    http
            .securityMatcher("/system/**", "/admin/**", "/identity/**")
            .cors().and().csrf().disable()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .anonymous()
            .and()
            .authorizeHttpRequests(auth -> auth
                    .requestMatchers(HttpMethod.OPTIONS).permitAll()
                    .requestMatchers("/system/**").hasRole(new SecurityRole(Role.ROLE_SYSTEM).toString())
                    .requestMatchers("/admin/**").hasRole(new SecurityRole(Role.ROLE_AUTH_ADMIN).toString())
                    .requestMatchers("/identity/**").hasRole(new SecurityRole(Role.ROLE_AUTH_IDENTITY).toString())
                    .anyRequest().authenticated()
            )
            .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);

    return http.build();
}

// 配置guest路径的安全规则
@Bean
@Order(2)
public SecurityFilterChain guestFilterChain(HttpSecurity http) throws Exception {
    http
            .securityMatcher("/guest/**")
            .cors().and().csrf().disable()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .authorizeHttpRequests(auth -> auth
                    .anyRequest().permitAll()
            );

    return http.build();
}

补充说明 #

• 方案二更符合Spring Security 5.4+推荐的多FilterChain配置方式，规则划分更清晰，避免过滤器对无关路径做不必要的处理。
• 两种方案都能让/guest/**路径的自定义异常正常返回409状态码，同时保证其他路径的JWT校验正常生效。

内容的提问来源于stack exchange，提问作者Romain Lavabre