spring-projects / spring-projects/spring-security

Expect AuthenticationException for invalid issuer instead of IllegalStateException

Open
#18,388 5 comments 0 reactions 1 assignee View on GitHub

@jzheaux is already working on this.

Since Sep 9, 2026.

in: oauth2 status: feedback-reminder status: waiting-for-feedback
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
Using oauth2 resource server with JWT authentication, if the client send a token with an issuer different from the one expected, the exception thrown is IllegalStateException : https://github.com/spring-projects/spring-security/blob/5fe6d9259fbee532d402a801527b7aed4d937e98/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtDecoderProviderConfigurationUtils.java#L99
The exception is never wrapped to AuthenticationException.

To Reproduce
Configure oauth2 resource server and exception handling :

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http.csrf(AbstractHttpConfigurer::disable)
    .authorizeHttpRequests(matcher -> matcher.anyRequest().authenticated())
    .oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults()))
    .exceptionHandling(exceptionHandling -> exceptionHandling
      .authenticationEntryPoint(authenticationEntryPoint())
      .accessDeniedHandler(accessDeniedHandler()))
    .build();
}

@Bean
public AuthenticationEntryPoint authenticationEntryPoint() {
    return (HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) -> {
        LOGGER.error("Authentication failed", authException);
    };
}

@Bean
public AccessDeniedHandler accessDeniedHandler() {
    return (HttpServletRequest request, HttpServletResponse response,
            org.springframework.security.access.AccessDeniedException accessDeniedException) -> {
        LOGGER.error("Access denied", accessDeniedException);
    };
}

Configure JWT expected issuer uri :

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://issuer-uri

Send a request with an other issuer-uri : the exception is not logged

Expected behavior
The exception is an AuthenticationException so we can catch it through httpSecurity.exceptionHandling() or Authentication events.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.