Skip to content

Invalid_request failures in JwtTokenValidators are always turned into invalid_token errors #10337

@jason076

Description

@jason076

Describe the bug
Returning any failure in a OAuth2TokenValidator validate function always results in a InvalidBearerTokenException with the error code BearerTokenErrorCodes.INVALID_TOKEN and returns a 401. The Error handling does not respect the Error code the validate function returns. This leads to OAuth2ErrorCodes.INVALID_REQUEST get converted to BearerTokenErrorCodes.INVALID_TOKEN.

To Reproduce
Return OAuth2ErrorCodes.INVALID_REQUEST in OAuth2TokenValidator validate. This was already the case in an bug I reported earlier: #10319

Expected behavior
If I return OAuth2ErrorCodes.INVALID_REQUEST failure from OAuth2TokenValidator validate I expect an OAuth2AuthenticationException with the BeareErrorCode BearerTokenErrorCodes.INVALID_REQUEST and the status code 400.

Sample
The problematic line in the sourcode is the following

Each BadJwtException is converted to InvalidBearerTokenException with the error code BearerTokenErrorCodes.INVALID_TOKEN

Metadata

Metadata

Assignees

Labels

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)status: backportedAn issue that has been backported to maintenance branchestype: bugA general bug

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions