Custom Exceptions for JWT authentication don’t work JAVa

I implemented in my API Rest JWT authentication, but the exceptions that I created don’t work.

This is what I expect:

"timestamp": "2022-06-02T21:56:28.372+00:00",
"error": "BAD_REQUEST",
"message": "Invalid JWT signature",

This is what I get:

"timestamp": "2022-06-02T22:12:25.698+00:00",
"status": 500,
"error": "Internal Server Error",
"trace": "com.onlinestore.app.exceptions.OnlineStoreAPIExceptionrntat com.onlinestore.app.security.JwtTokenProvider.validateToken(JwtTokenProvider.java:54)rntat com.onlinestore.app.security.JwtAuthenticationFilter.doFilterInternal(JwtAuthenticationFilter.java:36)rntat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)rntat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)rntat org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103)rntat org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89)rntat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)rntat org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90)rntat org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75)rntat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)rntat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)rntat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110)rntat org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80)rntat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)rntat org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55)rntat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)rntat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336)rntat org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211)rntat org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183)rntat org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354)rntat org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267)rntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)rntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)rntat org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)rntat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)rntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)rntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)rntat org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)rntat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)rntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)rntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)rntat org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)rntat org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)rntat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)rntat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)rntat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)rntat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)rntat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)rntat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)rntat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)rntat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)rntat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)rntat org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)rntat org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)rntat org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890)rntat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743)rntat org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)rntat org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)rntat org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)rntat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)rntat java.base/java.lang.Thread.run(Thread.java:833)rn",
"message": "No message available",
"path": "/api/v1/placeorder"

This is my CustomException Class

public class OnlineStoreAPIException  extends RuntimeException{

     private HttpStatus status;
     private String message;

     public OnlineStoreAPIException(HttpStatus status, String message) {
         this.status = status;
         this.message = message;
     }

     public OnlineStoreAPIException(String message, HttpStatus status, String message1){
         super(message);
         this.status = status;
         this.message = message1;
     }

     public HttpStatus getStatus() {
         return status;
     }

    @Override
    public String getMessage() {
         return message;
    }
}

This is what I have in my globalExceptionHandler

 @ControllerAdvice
 public class globalExceptionHandler extends ResponseEntityExceptionHandler {

 @ExceptionHandler(OnlineStoreAPIException.class)
 public ResponseEntity<ErrorDetails> 
 handlerOnlineStoreAPIException(OnlineStoreAPIException ex , WebRequest webRequest){

    ErrorDetails errorDetails = new ErrorDetails(new Date(), ex.getMessage(), 
                                webRequest.getDescription(false));

    return new ResponseEntity<ErrorDetails>(errorDetails, HttpStatus.BAD_REQUEST);

}

And finally this is what I have in the method validateToken in JwtTokenProvider:

public boolean validateToken(String token){

    try{
        Jwts.parser().setSigningKey(jwtSecret).parseClaimsJws(token);
        return true;
    }catch (SignatureException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Invalid JWT signature");
    }
    catch (MalformedJwtException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Invalid JWT token");
    }
    catch (ExpiredJwtException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Expired JWT token");
    }
    catch (UnsupportedJwtException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "Unsupported JWT token");
    }
    catch (IllegalArgumentException ex){
        throw new OnlineStoreAPIException(HttpStatus.BAD_REQUEST, "JWT claims string is empty");
    }
}

I really appreciate if someone can give a hand.

Answer

This is because Spring filters have a different error response mechanism, separate to general exceptions. In this sample of mine I am using a custom filter to do the OAuth work.

The more standard Spring option is to customize the AccessDeniedHandler as discussed in this tutorial.

http.authorizeRequests()
        // other configurations
     .and().oauth2ResourceServer()
     .authenticationEntryPoint(new CustomOAuth2AuthenticationEntryPoint())
        .accessDeniedHandler(new CustomOAuth2AccessDeniedHandler();