Implement custom exception handler for error Forbidden

Question

I want to create custom exception handler which returns a structured JSON response with data. I tried this:

@ExceptionHandler({ AccessDeniedException.class })
public ResponseEntity<ErrorResponseDTO> accessDeniedExceptionHandler(final AccessDeniedException ex) {
    ErrorDetail errorDetail = ErrorDetail.NOT_FOUND;

    LOG.error(ex.getMessage(), ex.getCause());
    ErrorResponse errorEntry = new ErrorResponse();
    .......

    return new ResponseEntity<ErrorResponseDTO>(errorResponse, HttpStatus.FORBIDDEN);
}

Full code: Github

But I get this generic result:

{
  "timestamp": "2020-06-06T22:46:13.815+00:00",
  "status": 403,
  "error": "Forbidden",
  "message": "",
  "path": "/engine/users/request"
}

I want to get only this result:

{
  "errors": [{
    "status": 404,
    "code": "1000",
    "title": "Forbidden",
    "detail": "Forbidden",
    "extra": {
      "detail": "Forbidden"
    }
  }]
}

Do you know how I can send custom result and how I can solve this issue?

Answer 1

Simply create a DTO class, and return as a normal response:

class Error {
    long status;
    long code;
    String title;
    String detail;
    Extra extra;

    // constructor for all argument...
}

Inside handler create an object of the above class and send the object in ResponseEntity:

Error error = new Error(args....);
return new ResponseEntity<Object>(error, HttpStatus.FORBIDDEN);

Answer 2

well, I think you can do custom error for access denied exception in this way

import com.fasterxml.jackson.databind.ObjectMapper;
import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.MediaType;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServletResponse;

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    private final ObjectMapper om;

    public SecurityConfiguration() {
        this.om = new ObjectMapper();
        this.om.setDefaultPropertyInclusion(JsonInclude.Include.NON_NULL);
    }

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        http
            .exceptionHandling()
            .accessDeniedHandler((request, response, accessDeniedException) -> {
                response.setStatus(HttpServletResponse.SC_FORBIDDEN);
                response.setContentType(MediaType.APPLICATION_JSON_VALUE);
                ServletOutputStream out = response.getOutputStream();
                om.writeValue(
                    out,
                    ErrorDto
                    .builder()
                        .code(1000)
                        .title("Forbidden")
                        .detail("Forbidden")
                        .status(404)
                    .build()
                );
                out.flush();
            }).and()
            .authorizeRequests().antMatchers("/api/**").authenticated()
            .and()
            .httpBasic()
            .and()
            .formLogin().disable();
    }

    @Data
    @AllArgsConstructor
    @NoArgsConstructor
    @Builder
    private static class ErrorDto{
        private int status;
        private int code;
        private String title;
        private String detail;
        // other fields
    }
}

Answer 3

To implement custom exception handler:

1. Specify the endpoint adress, which handles all error types and Exceptions, in the web.xml:

   <error-page>
       <location>/error</location>
   </error-page>
   

2. Add corresponding error handler method:

   @RequestMapping(value = "/error", produces = MediaType.APPLICATION_JSON_VALUE)
   public ResponseEntity<?> handleError(
           @RequestAttribute(name = "javax.servlet.error.status_code",
                   required = false) Integer errorCode,
           @RequestAttribute(name = "javax.servlet.error.exception",
                   required = false) Throwable exception) {
   
       if (errorCode == null) {
           errorCode = 500;
       }
   
       String reasonPhrase;
       if (exception != null) {
           Throwable cause = exception.getCause();
           if (cause != null) {
               reasonPhrase = cause.getMessage();
           } else {
               reasonPhrase = exception.getMessage();
           }
       } else {
           reasonPhrase = HttpStatus.valueOf(errorCode).getReasonPhrase();
       }
   
       HashMap<String, String> serverResponse = new HashMap<>();
       serverResponse.put("errorCode", String.valueOf(errorCode));
       serverResponse.put("reasonPhrase", reasonPhrase);
   
       return ResponseEntity.status(errorCode).body(serverResponse);
   }
   

3. Sending an ajax request from the frontend (I wrote it in AngularJS):

   http({
       url: '/someEndpoint',
       method: "POST",
       headers: {'Content-Type': undefined },
   }).then((response) => successCallback(response),
       (response) => errorCallback(response));
   
   let successCallback = function(response) {
       // console.log(response);
       mdToast.show({
           position: 'bottom right',
           template: scope.templates.success('Success message'),
       });
   };
   
   let errorCallback = function(response) {
       // console.log(response);
       mdToast.show({
           position: 'bottom right',
           template: scope.templates.error('Error message'),
       });
       if (response && response.data && response.data.reasonPhrase) {
           mdToast.show({
               position: 'bottom right',
               template: scope.templates.error(response.data.reasonPhrase),
           });
       }
   };
   

   First it says, that there was an error, and then says what error it was.

---

For example, if the server returns something unexpected:

@GetMapping({"/", "/index.html"})
public ResponseEntity<?> getMainPage() throws Exception {
    throw new Exception("Something unexpected..");
}

The client receives this kind of JSON message:

{
    "reasonPhrase": "Something unexpected..",
    "errorCode": "500"
}

Or server may return something less unexpected:

@GetMapping({"/", "/index.html"})
public ResponseEntity<?> getMainPage() {
    try {
        // expected actions
        // . . .
    } catch (Exception e) {
        HashMap<String, String> serverResponse = new HashMap<>();
        serverResponse.put("errorCode", "403"));
        serverResponse.put("reasonPhrase", "Forbidden");

        return ResponseEntity.status(403).body(serverResponse);
    }
}

Client:

{
    "reasonPhrase": "Forbidden",
    "errorCode": "403"
}

---

Also, if a client requests an unreachable resource or a page that does not exist, then he receives:

{
    "reasonPhrase": "Not Found",
    "errorCode": "404"
}

Answer 4

Return a String after using writeValueAsString:

return new ResponseEntity<String>(
        new ObjectMapper().writer().writeValueAsString(errorObj),
        HttpStatus.FORBIDDEN);