SpringBoot+SpringSecurity 认证失败返回错误信息

AbstractAuthenticationProcessingFilter

Spring Security对于请求是经过一系列Filter进行拦截的，其中用户登录验证这类的处理都是在UsernamePasswordAuthenticationFilter中，它继承自AbstractAuthenticationProcessingFilter。

在AbstractAuthenticationProcessingFilter里面对于登录失败这类异常的处理都在doFilter方法中

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
    	throws IOException, ServletException {
    
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    
    if (!requiresAuthentication(request, response)) {
    	chain.doFilter(request, response);
    
    	return;
    }
    
    if (logger.isDebugEnabled()) {
    	logger.debug("Request is to process authentication");
    }
    
    Authentication authResult;
    
    try {
    	authResult = attemptAuthentication(request, response);
    	if (authResult == null) {
    		// return immediately as subclass has indicated that it hasn't completed
    		// authentication
    		return;
    	}
    	sessionStrategy.onAuthentication(authResult, request, response);
    }
    catch (InternalAuthenticationServiceException failed) {
    	logger.error(
    			"An internal error occurred while trying to authenticate the user.",
    			failed);
    	unsuccessfulAuthentication(request, response, failed);
    
    	return;
    }
    catch (AuthenticationException failed) {
    	// Authentication failed
    	unsuccessfulAuthentication(request, response, failed);
    
    	return;
    }
    
    // Authentication success
    if (continueChainBeforeSuccessfulAuthentication) {
    	chain.doFilter(request, response);
    }
    
    successfulAuthentication(request, response, chain, authResult);
}
复制代码