java - Spring Security BadCredentialsException如何映射到HTTP 401代码

Question

当我抛出一个 org.springframework.security.authentication.BadCredentialsException 异常时，在客户端它会显示 401 如下，

{
  "timestamp": "2016-03-29T09:07:50.866+0000",
  "status": 401,
  "error": "Unauthorized",
  "message": "Some message",
  "path": "/test/service1/getAll"
}

我想知道 BadCredentialsException 在哪里以及如何映射到 HTTP 401 状态代码？

Answer 1

是ExceptionTranslationFilter处理安全拦截器抛出的异常并提供合适的 HTTP 响应:

The ExceptionTranslationFilter sits above the FilterSecurityInterceptor in the security filter stack. It doesn’t do any actual security enforcement itself, but handles exceptions thrown by the security interceptors and provides suitable and HTTP responses.

查看 Spring Security 文档以获取更多信息 here和 here .