如何在Spring WebFlux WebFilter中终止请求并返回自定义响应？

Got it, let's work through this. When handling JWT validation in a Spring WebFlux WebFilter, returning Mono.empty() terminates the request, but you need to explicitly build and send the error response first. Here's how to implement custom error messages for your exception cases:

Key Steps to Build Error Responses #

In WebFlux, use the ServerHttpResponse from the ServerWebExchange to construct your error response:

• Grab the response object from the exchange
• Set the appropriate HTTP status code (e.g., 401 for invalid tokens, 500 for server errors)
• Configure the response content type (plain text or JSON)
• Write your error message to the response body
• Return the write operation's Mono<Void> to complete request handling (instead of continuing the filter chain)

Modified Filter Code #

Here's your updated filter method with proper error response handling:

@Override
public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
    String token = exchange.getRequest().getHeaders().getFirst("token");
    ServerHttpResponse response = exchange.getResponse();

    // 验证Token
    try {
        Algorithm algorithm = Algorithm.HMAC256("secret");
        // 建议提前初始化验证器（比如放到@Bean里），避免每次请求重复创建
        JWTVerifier verifier = JWT.require(algorithm)
                .withIssuer("auth0")
                .build(); 
        DecodedJWT jwt = verifier.verify(token);
        
        // Token验证通过，继续执行后续过滤器/请求处理
        return chain.filter(exchange);
    } catch (UnsupportedEncodingException exception) {
        // 返回500 Internal Server Error响应
        response.setStatusCode(HttpStatus.INTERNAL_SERVER_ERROR);
        response.getHeaders().setContentType(MediaType.TEXT_PLAIN);
        DataBuffer buffer = response.bufferFactory().wrap("Internal Server Error".getBytes());
        // 确保写入出错时释放缓冲区，避免内存泄漏
        return response.writeWith(Mono.just(buffer))
                .doOnError(error -> DataBufferUtils.release(buffer));
    } catch (JWTVerificationException exception) {
        // 返回401 Unauthorized + Invalid token响应
        response.setStatusCode(HttpStatus.UNAUTHORIZED);
        response.getHeaders().setContentType(MediaType.TEXT_PLAIN);
        DataBuffer buffer = response.bufferFactory().wrap("Invalid token".getBytes());
        return response.writeWith(Mono.just(buffer))
                .doOnError(error -> DataBufferUtils.release(buffer));
    }
}

Important Notes #

• Reusable Verifier: Initialize the JWTVerifier once (e.g., in a @Bean) instead of creating it per request to save resources.
• DataBuffer Cleanup: Always release the DataBuffer on write errors using DataBufferUtils.release() to prevent memory leaks.
• JSON Responses: For JSON-formatted errors, change the content type to MediaType.APPLICATION_JSON and wrap your message in a JSON string (e.g., "{\"error\":\"Invalid token\"}").

内容的提问来源于stack exchange，提问作者Roshan Gade