Make DefaultRequestRejectedHandler Return HTTP 400 by default

Expected Behavior

DefaultRequestRejectedHandler should return HTTP 400 by default instead of having to implement a custom bean.

Sample request ->

curl --location --request GET 'http://localhost:8080/./'
--header 'Content-Type: application/json'
--header 'Accept-Language: en-us'
--header 'Accept: application/json'

Should return ->

{
"timestamp": "2023-04-24T15:21:47.865+00:00",
"status": 400,
"error": "Internal Server Error",
"path": "/./"
}

Current Behavior

curl --location --request GET 'http://localhost:8080/./'
--header 'Content-Type: application/json'
--header 'Accept-Language: en-us'
--header 'Accept: application/json'

Returns->

{
"timestamp": "2023-04-24T15:21:47.865+00:00",
"status": 500,
"error": "Internal Server Error",
"path": "/./"
}

Context

Currently the DefaultRequestRejectedHandler lets the RequestRejectedException bubble out and return an HTTP 500 and has no logging. I think a more accurate status code is HTTP 400. https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/firewall/DefaultRequestRejectedHandler.java#L37

I was also unable to use HttpStatusRequestRejectedHandler because the log level used is debug when I think the log level should be error. https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/firewall/HttpStatusRequestRejectedHandler.java#L59

This required me to implement this workaround. Similar to a recommendation made here https://stackoverflow.com/questions/51788764/how-to-intercept-a-requestrejectedexception-in-spring

@Log4j2
public class CustomRequestRejectedHandler implements RequestRejectedHandler {
  @Override
  public void handle(
      HttpServletRequest request,
      HttpServletResponse response,
      RequestRejectedException requestRejectedException)
      throws IOException, ServletException {
    log.error("Framework rejected request.", requestRejectedException);
    response.sendError(HttpStatus.SC_BAD_REQUEST);
  }
}

  @Bean
  public RequestRejectedHandler requestRejectedHandler() {
    return new CustomRequestRejectedHandler();
  }

I do think this is low priority because there is a pretty simple workaround however I do think the correct status code is HTTP 400 so that should be the default behavior.

As a separate issue I think the log level in HttpStatusRequestRejectedHandler should be changed to error.

I'm also willing to open the Pull Request for this change if you consider this a valid enhancement. Please let me know. Thank you in advance!

Start with web/src/main/java/org/springframework/security/web/firewall/DefaultRequestRejectedHandler.java, linked in the issue, and compare it with HttpStatusRequestRejectedHandler.java. Verify the current behavior for a rejected /./ request, then ensure the default handler produces HTTP 400 and decide separately whether the logging-level concern belongs in this change.