Throwing an Exception inside AuthenticationProvider.authentication() causes a return 200.

[tggm]

Summary

AuthenticationProvider implementations deal with exceptions differently in the authenticate() method.

Actual Behavior

Consider an AuthenticationProvider (org.springframework.security.authentication.AuthenticationProvider) implementation. If the authenticate(Authentication authentication) method throws a java.lang.Exception the framework will return an HTTP 200 code to the client.

If, however, an AuthenticationException is raised (for instance a concrete AuthenticationServiceException) the framework will return a 403 response code.

Expected Behavior

Any exception inside an authentication provider should cause a 403 error.

Configuration

WebSecurity config

	http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER);
	http.csrf().disable();

	http.addFilterBefore(bearerTokenFilter(), BasicAuthenticationFilter.class)
		.anonymous()
		.authorities("ROLE_ANONYMOUS")
		.and().authorizeRequests()
		.antMatchers("/heartbeat").permitAll()
		.anyRequest().authenticated()
		.and().headers().cacheControl().disable()
		.and().exceptionHandling();
}

ResponseEntityExceptionHandler

@ControllerAdvice
public class RestApiExceptionHandler extends ResponseEntityExceptionHandler {
	@ExceptionHandler({Exception.class})
	public ResponseEntity<Object> handleAccessDeniedException(Exception ex, WebRequest request) {
		return new ResponseEntity<Object>(new RestOperationResult(false, "auth_session_expired"), new HttpHeaders(), HttpStatus.UNAUTHORIZED);
	}

	@ExceptionHandler({Throwable.class})
	public ResponseEntity<Object> handleAll(Exception ex, WebRequest request) {
		return new ResponseEntity<Object>(new RestOperationResult(false, "Service Error"), new HttpHeaders(), HttpStatus.INTERNAL_SERVER_ERROR);
	}
}

Version

spring-security-core-5.2.0.RELEASE

[eleftherias]

@tggm Can you provide some more detail on the type of exception you are trying to throw?
The method signature is as follows

Authentication authenticate(Authentication authentication) throws AuthenticationException;

so this method would not be allowed to throw a java.lang.Exception.
It can only throw an AuthenticationException or an unchecked exception.

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[tggm]

Apologies for the delay.

Yes, in this instance the exception thrown was an Unchecked Exception (Derived from RuntimeException). This caused the framework to return a HTTP 200 code to the client.

[eleftherias]

@tggm I'm having difficulty reproducing the problem.
I am seeing an HTTP 500 status returned when throwing a RuntimeException in the authenticate method.
Can you please provide a sample that reproduces this issue?

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[spring-projects-issues]

Closing due to lack of requested feedback. If you would like us to look at this issue, please provide the requested information and we will re-open the issue.