Support RFC 9457 error details for OAuth2 JWT validation

Expected Behavior

when this is used:

 @Bean
    SecurityFilterChain configure(HttpSecurity http, AuthorizationManager<RequestAuthorizationContext> authz)
            throws Exception {
      http.oauth2ResourceServer(c -> c.jwt(Customizer.withDefaults()));

and a invalid JWT is used to access any Rest Endpoints, I would expect that spring framework returns RFC 9457 error details, or at least make it somehow configurable to do so.

Current Behavior

it returns an empty body and some 4xx error status.

Context

• What other alternatives have you considered?

I tried some ideas using :

  SecurityFilterChain configure(HttpSecurity http, AuthorizationManager<RequestAuthorizationContext> authz)
            throws Exception {
        http.oauth2ResourceServer(oauth2 -> oauth2
                        .jwt(jwt -> jwt
                                .jwtAuthenticationConverter(jwtAuthenticationConverter())
                        )
                        .authenticationEntryPoint(new BearerTokenAuthenticationEntryPoint())
                        .accessDeniedHandler(new BearerTokenAccessDeniedHandler())
                )
                .exceptionHandling(exceptionHandling -> exceptionHandling
                        .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
                );

and

@Slf4j
@RestControllerAdvice
public final class GlobalExceptionHandler extends ResponseEntityExceptionHandler {
    @ExceptionHandler(JwtException.class)
    public ProblemDetail handleJwtException(JwtException ex) {
        ProblemDetail problemDetail = ProblemDetail.forStatusAndDetail(HttpStatus.UNAUTHORIZED, ex.getMessage());
        problemDetail.setTitle("Unauthorized");
        problemDetail.setType(URI.create("https://example.com/unauthorized"));
        return problemDetail;
    }

but was never able to catch the JWTException in order to put RFC 9457 error details into the response body .

• What are you trying to accomplish?
  comply with https://www.rfc-editor.org/rfc/rfc9457.html

• Are you aware of any workarounds?
  yes , but with no success.

Start at the oauth2ResourceServer JWT configuration and trace how invalid JWT failures reach the authenticationEntryPoint or accessDeniedHandler rather than the RestControllerAdvice and JwtException handler. Compare the resulting response with RFC 9457 and determine whether configurable ProblemDetail output is required; done means invalid JWT requests return the agreed RFC 9457 error details.