未经授权的错误401返回内部服务器错误500

Question

我使用spring ide在本地机器嵌入式apache服务器上部署了spring boot web应用程序，并访问了一个带有错误令牌的url，在这种情况下，它会返回未经授权的访问错误401和托管异常处理抛出的特定错误消息，而如果我在独立但相同的apache服务器上部署相同的应用程序，它会给我500个内部服务器错误而不是401或任何其他服务器端错误。

我捕获的日志只有以下一行不同：

local
------------------
2021-10-13 16:59:51 - Authentication Failed. Invalid signature in token.
2021-10-13 16:59:51 - Servlet.service() for servlet [dispatcherServlet] in context with path [/myapplication] threw exception
java.lang.RuntimeException: Authentication Failed. Invalid signature in token.

server
------------------
2021-10-13 16:59:35 - Authentication Failed. Invalid signature in token.
2021-10-13 16:59:35 - Forwarding to error page from request [/user/get_user_profile] due to exception [Authentication Failed. Invalid signature in token.]
java.lang.RuntimeException: Authentication Failed. Invalid signature in token.

下面是我用来处理异常的配置：

@Autowired
private JwtAuthenticationEntryPoint unauthorizedHandler;
http.cors().and().csrf().disable()
        .authorizeRequests()
        .antMatchers("admin/**").permitAll()
        .anyRequest().authenticated()
        .and()
        .exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
        .and()
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

http.addFilterBefore(authenticationFilter(), UsernamePasswordAuthenticationFilter.class);

这是处理异常的类：

public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint, Serializable {
    private static final long serialVersionUID = -90731367144543199L;

    @Override
    public void commence(HttpServletRequest request,
                     HttpServletResponse response,
                     AuthenticationException authException) throws IOException {

        response.getOutputStream().println(authException);
    }
}

Answer 1

与其在筛选器中引发异常，不如如下设置其状态：

response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);  
response.getWriter().write("Here will be your message string"); //show error message
return;