Spring Boot 3: ResponseStatusException does not work

[xuanswe]

1. Download generated code from https://start.spring.io
   

2. Replace content of DemoApplication.kt with the following code

@SpringBootApplication
class DemoApplication

fun main(vararg args: String) {
  SpringApplication.run(DemoApplication::class.java, *args)
}

@RestController
class HelloController {
  @GetMapping("/public-api/hello")
  fun hello(@RequestParam error: Boolean = false) =
    if (error)
      throw ResponseStatusException(HttpStatus.BAD_REQUEST)
    else
      ResponseEntity.ok().build<Unit>()
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
  @Bean
  fun securityFilterChain(http: HttpSecurity) = http
    .csrf().disable()
    .httpBasic().disable()
    .authorizeHttpRequests { requests ->
      requests
        .requestMatchers("/public-api/**").permitAll()
        .anyRequest().authenticated()
    }
    .build()
}

3. PROBLEM: Request http://localhost:8080/public-api/hello?error=true returns "403 Forbidden"
4. Now in build.gradle.kts, change id("org.springframework.boot") version "3.0.2" to id("org.springframework.boot") version "2.7.8"
5. In DemoApplication.kt, change requestMatchers("/public-api/**") to antMatchers("/public-api/**") because requestMatchers is not available in Spring Boot 2.
6. CORRECT: Request http://localhost:8080/public-api/hello?error=true returns "400 Bad Request" with body

{
    "timestamp": "2023-01-22T13:39:18.084+00:00",
    "status": 400,
    "error": "Bad Request",
    "path": "/public-api/hello"
}

[philwebb]

By default Spring Boot 3.0 also applies security to error dispatches. In your example, the .requestMatchers("/public-api/**") filter is working but there's no equivalent rule for permitting errors.

Try adding:

requests.requestMatchers("/error").permitAll();

to your configuration.

[xuanswe]

@philwebb nice. It works. Thanks!
So, in Spring 2, /error is allowed regardless of custom authorizeHttpRequests.
In Spring 3, if there's a custom authorizeHttpRequests, the default security rules are disabled. Therefore, we need to explicitly redefine them.

[mbhave]

@xuan-nguyen-swe The reason why /error worked in 2.x was because we had a custom filter which checked if a user should be granted access to the error page or not. In Spring Boot 3.0, we removed the custom filter to align with Spring Security's defaults which always apply the security filter to the error dispatch.

One thing to note is that, adding permitAll to the /error page is not quite the same as the getting the behavior from Spring Boot 2.7.x back. permitAll() allows anyone to access the error page while in Spring Boot 2.7, the default was only to allow access to the error page if access to the original request was allowed. It's good to verify that public access to the error page is okay before adding permitAll. I've created an issue in Spring Security to see if this can be fixed there.