Spring Security：自定义AuthenticationFilter中如何正确处理IO异常？

针对你遇到的读取请求体时IOException无法直接抛出的问题，正确的处理方式是自定义继承Spring Security的AuthenticationException的异常，原因如下：

• 父方法attemptAuthentication允许抛出AuthenticationException及其子类，完全符合方法签名要求
• Spring Security的过滤器链异常处理机制（如ExceptionTranslationFilter）会识别这类认证相关异常，返回更合理的HTTP响应（而非默认的500服务器错误）

步骤1：自定义认证异常 #

创建一个继承AuthenticationException的异常类，专门封装请求体读取失败的场景：

public class RequestBodyReadException extends AuthenticationException {
    public RequestBodyReadException(String msg, Throwable cause) {
        super(msg, cause);
    }
}

步骤2：修改过滤器的异常抛出逻辑 #

在attemptAuthentication方法中捕获IOException后，抛出自定义的认证异常。同时建议把ObjectMapper作为Spring Bean注入，避免重复实例化，也方便统一配置序列化规则：

@RequiredArgsConstructor
public class AuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    private final AuthenticationManager authenticationManager;
    private final ObjectMapper objectMapper; // 注入Spring容器中的ObjectMapper实例

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException {
        try {
            UserDTO user = objectMapper.readValue(request.getInputStream(), UserDTO.class);
            UsernamePasswordAuthenticationToken authenticationToken =
                    new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword());
            return authenticationManager.authenticate(authenticationToken);
        } catch (IOException e) {
            // 抛出自定义认证异常，携带友好提示和原异常栈信息
            throw new RequestBodyReadException("读取认证请求体失败，请检查请求格式是否正确", e);
        }
    }
}

额外优化：自定义异常响应格式 #

如果需要返回JSON格式的错误信息而非默认的页面，可以配置AuthenticationEntryPoint，在捕获到RequestBodyReadException时返回400 Bad Request及自定义响应体：

@Component
public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {
    private final ObjectMapper objectMapper;

    public CustomAuthenticationEntryPoint(ObjectMapper objectMapper) {
        this.objectMapper = objectMapper;
    }

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
        response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        // 构造自定义错误响应结构
        Map<String, Object> errorResponse = new HashMap<>();
        errorResponse.put("code", "BAD_REQUEST");
        errorResponse.put("message", authException.getMessage());
        objectMapper.writeValue(response.getOutputStream(), errorResponse);
    }
}

然后在Spring Security配置类中指定这个EntryPoint：

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    private final CustomAuthenticationEntryPoint authenticationEntryPoint;
    private final AuthenticationManager authenticationManager;
    private final ObjectMapper objectMapper;

    public SecurityConfig(CustomAuthenticationEntryPoint authenticationEntryPoint,
                          AuthenticationManager authenticationManager,
                          ObjectMapper objectMapper) {
        this.authenticationEntryPoint = authenticationEntryPoint;
        this.authenticationManager = authenticationManager;
        this.objectMapper = objectMapper;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .exceptionHandling(ex -> ex.authenticationEntryPoint(authenticationEntryPoint))
                .addFilterAt(new AuthenticationFilter(authenticationManager, objectMapper), UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
}

这样处理后，当请求体格式错误或读取失败时，会返回400状态码和结构化的JSON错误信息，既符合REST API规范，也能被Spring Security的异常处理流程正确识别。

内容的提问来源于stack exchange，提问作者Luk