-
Notifications
You must be signed in to change notification settings - Fork 6.1k
Description
Describe the bug
Returning any failure in a OAuth2TokenValidator
validate
function always results in a InvalidBearerTokenException
with the error code BearerTokenErrorCodes.INVALID_TOKEN
and returns a 401. The Error handling does not respect the Error code the validate function returns. This leads to OAuth2ErrorCodes.INVALID_REQUEST
get converted to BearerTokenErrorCodes.INVALID_TOKEN
.
To Reproduce
Return OAuth2ErrorCodes.INVALID_REQUEST
in OAuth2TokenValidator
validate
. This was already the case in an bug I reported earlier: #10319
Expected behavior
If I return OAuth2ErrorCodes.INVALID_REQUEST
failure from OAuth2TokenValidator
validate
I expect an OAuth2AuthenticationException
with the BeareErrorCode
BearerTokenErrorCodes.INVALID_REQUEST
and the status code 400.
Sample
The problematic line in the sourcode is the following
Line 101 in 8c74d6c
throw new InvalidBearerTokenException(failed.getMessage(), failed); |
Each BadJwtException
is converted to InvalidBearerTokenException
with the error code BearerTokenErrorCodes.INVALID_TOKEN