Customizing Exception Responses in Spring Security OAuth2

The author introduces the fourth article of the "Spring Security Advanced" series, focusing on customizing exception information for real‑world Spring Security projects.

First, the article revisits the previously built authentication service ( oauth2-auth-server-jwt) and resource service ( oauth2-auth-resource-jwt), showing their architecture diagrams.

It then lists three common authentication‑service errors (wrong username/password, unsupported grant type, and incorrect client ID/secret) and displays the default error responses returned by Spring Security.

To replace these unfriendly messages, the author proposes two solution groups: (1) username/password and grant‑type errors, and (2) client ID/secret errors.

1. Username/Password and Grant‑Type Errors

The solution includes:

Customizing the error message and HTTP status code.

Implementing a custom WebResponseExceptionTranslator by overriding the translate(Exception e) method.

Registering the custom translator in AuthorizationServerConfig.

Code example for the translator method:

ResponseEntity<T> translate(Exception e) throws Exception

Configuration screenshot shows the single‑line bean registration.

2. Client ID/Secret Errors

The approach mirrors the first group but uses a custom AuthenticationEntryPoint and modifies ClientCredentialsTokenEndpointFilter to invoke the new entry point.

Key steps:

Define OAuthServerAuthenticationEntryPoint implementing AuthenticationEntryPoint.

Extend ClientCredentialsTokenEndpointFilter, injecting the custom entry point and overriding getAuthenticationManager() and afterPropertiesSet().

Add the filter to AuthorizationServerSecurityConfigurer before BasicAuthenticationFilter.

Important note: enabling allowFormAuthenticationForClients() would create the default filter and override the custom one.

Resource Server Exception Handling

After obtaining a token, the resource server may encounter two errors: token expiration/invalidity and insufficient permissions.

For token expiration, a custom AuthenticationEntryPoint is defined and registered in the security configuration.

For insufficient permissions, a custom AccessDeniedHandler is created and wired similarly.

Testing screenshots demonstrate the customized JSON responses for each scenario.

Throughout the article, the author repeatedly reminds readers that the full source code is available on GitHub and encourages following the public account "码猿技术专栏" for additional resources.