Is it possible to configure OAuth2 in Spring Boot to respond with JSON instead of HTML for InvalidTokenException?

Question

My Spring Boot application uses OAuth2 for security and token management. I’m querying one of my REST endpoints with an invalid token to test its response using Postman. The endpoint is correctly responding with 401 InvalidTokenException but the response content is HTML when I would like it to respond with JSON. Can this be done via code?

Example response

<InvalidTokenException> 
    <error>invalid_token</error> 
    <error_description>Access token expired: … my token… </error_description> 
</InvalidTokenException>

Can you clarify your Boot version and the OAuth dependencies? The reason is that Spring Security undergone a pretty massive change in their OAuth 2.0 support in the last couple of years. — jzheaux, Apr 10 '20 at 22:30

score 1 · Answer 1 · answered Apr 10 '20 at 11:11

Add custom AuthenticationFailureHandler to your security configuration and then prepare response in your custom implementation:

http.oauth2Login()
    .failureHandler(customFailureHandler)

Failure handler example:

public class CustomFailureHandler extends SimpleUrlAuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException {
        response.sendError(401, "XML HERE");
    }
}

score 1 · Accepted Answer · answered Apr 22 '20 at 09:36

To elaborate on zfChaos's answer, which is a good lead but does not provide sufficient information for the response to be a JSON response:

You should also set the content type and character encoding. Then, write your JSON response (in this example I used a simple String, of course it would be more convenient use a class and an ObjectMapper).

Here is a complete example:

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
                .oauth2Login(login -> login
                        .failureHandler((request, response, exception) -> {
                            response.setContentType("application/json");
                            response.setStatus(401);
                            response.setCharacterEncoding("UTF-8");
                            response.getWriter().write("{ \"msg\": \"foo\" }");
                        })
                );
    }
}

Thank you both, those were very helpful answers – Space Cadet Apr 27 '20 at 09:03 — Space Cadet, Apr 27 '20 at 09:03

Is it possible to configure OAuth2 in Spring Boot to respond with JSON instead of HTML for InvalidTokenException?

2 Answers2