Spring Boot 2 - 基于过滤器的 JWT Spring Security 实现中的 403 而不是 401

使用过滤器实现基于JWT的Spring Security时，我们可能会遇到403错误而不是预期的401错误。本文将介绍如何解决这个问题，并提供相关的案例代码。

java
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        // 验证和解析JWT
        // ...
        filterChain.doFilter(request, response);
    }
}

java
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/api/public").permitAll()
                .anyRequest().authenticated()
                .and()
                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
                .exceptionHandling()
                .authenticationEntryPoint((request, response, authenticationException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"));
    }
}

java
@RestController
public class ApiController {
    @GetMapping("/api/public")
    public ResponseEntity publicApi() {
        return ResponseEntity.ok("Public API");
    }
    @GetMapping("/api/private")
    public ResponseEntity privateApi() {
        return ResponseEntity.ok("Private API");
    }
}