spring-projects / spring-projects/spring-security
Expect AuthenticationException for invalid issuer instead of IllegalStateException
@jzheaux is already working on this.
Since Sep 9, 2026.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
Using oauth2 resource server with JWT authentication, if the client send a token with an issuer different from the one expected, the exception thrown is IllegalStateException : https://github.com/spring-projects/spring-security/blob/5fe6d9259fbee532d402a801527b7aed4d937e98/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtDecoderProviderConfigurationUtils.java#L99
The exception is never wrapped to AuthenticationException.
To Reproduce
Configure oauth2 resource server and exception handling :
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
return http.csrf(AbstractHttpConfigurer::disable)
.authorizeHttpRequests(matcher -> matcher.anyRequest().authenticated())
.oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults()))
.exceptionHandling(exceptionHandling -> exceptionHandling
.authenticationEntryPoint(authenticationEntryPoint())
.accessDeniedHandler(accessDeniedHandler()))
.build();
}
@Bean
public AuthenticationEntryPoint authenticationEntryPoint() {
return (HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) -> {
LOGGER.error("Authentication failed", authException);
};
}
@Bean
public AccessDeniedHandler accessDeniedHandler() {
return (HttpServletRequest request, HttpServletResponse response,
org.springframework.security.access.AccessDeniedException accessDeniedException) -> {
LOGGER.error("Access denied", accessDeniedException);
};
}
Configure JWT expected issuer uri :
spring:
security:
oauth2:
resourceserver:
jwt:
issuer-uri: https://issuer-uri
Send a request with an other issuer-uri : the exception is not logged
Expected behavior
The exception is an AuthenticationException so we can catch it through httpSecurity.exceptionHandling() or Authentication events.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.