Error handling for a Spring-based REST API

Spring Boot provides pretty nifty defaults to handle exceptions and formulate a helpful response in case anything goes wrong. Still, for any number of reasons, an exception can be thrown at runtime and the consumers of your API may get a garbled exception message (or worse, no message at all) with a 500 Internal Server Error response.

Such a scenario is undesirable, because of the

• usability concerns Although relevant, the default exception message may not be helpful to the consumers of your API.
• security concerns The exception message may expose the internal details of your application to anyone using the API.

This is a pretty common occurrence and customizing the error response so that it is easy to comprehend is often one of the requirements of the API design. Like many other niceties, Spring Boot does a lot of heavy lifting for you; it does not send binding errors (due to validation failure), exceptions, or stacktrace in a response unless you configure them otherwise (see server.error keys under Server Properties available for a Spring application).

In this post, we'll explore some of the ways to customize error responses returned by a REST API. We'll also cover some usecases when Spring Security comes into the picture.

You can launch an instance of Postgres with Docker using the following Compose file.

 1version: '3'
 2
 3services:
 4  db:
 5    image: postgres:13-alpine
 6    restart: always
 7    ports:
 8      - 5432:5432
 9    environment:
10      POSTGRES_USER: erin
11      POSTGRES_PASSWORD: richards

Execute the following command to launch the container.

docker-compose up -d

Configure the project

Generate a Spring Boot project with Spring Initializr, and add spring-boot-starter-web, spring-boot-starter-data-jdbc, and postgresql as dependencies.

Your pom.xml would look like this.

 1<?xml version="1.0" encoding="UTF-8"?>
 2<project xmlns="http://maven.apache.org/POM/4.0.0"
 3  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 4  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 5  <modelVersion>4.0.0</modelVersion>
 6
 7  <parent>
 8    <groupId>org.springframework.boot</groupId>
 9    <artifactId>spring-boot-starter-parent</artifactId>
10    <version>2.3.2.RELEASE</version>
11    <relativePath/> <!-- lookup parent from repository -->
12  </parent>
13
14  <groupId>dev.mflash.guides</groupId>
15  <artifactId>spring-rest-error-handling</artifactId>
16  <version>0.0.1-SNAPSHOT</version>
17
18  <properties>
19    <java.version>14</java.version>
20  </properties>
21
22  <dependencies>
23    <dependency>
24      <groupId>org.springframework.boot</groupId>
25      <artifactId>spring-boot-starter-web</artifactId>
26    </dependency>
27
28    <dependency>
29      <groupId>org.springframework.boot</groupId>
30      <artifactId>spring-boot-starter-data-jdbc</artifactId>
31    </dependency>
32    <dependency>
33      <groupId>org.postgresql</groupId>
34      <artifactId>postgresql</artifactId>
35      <scope>runtime</scope>
36    </dependency>
37  </dependencies>
38
39  <build>
40    <plugins>
41      <plugin>
42        <groupId>org.springframework.boot</groupId>
43        <artifactId>spring-boot-maven-plugin</artifactId>
44      </plugin>
45    </plugins>
46  </build>
47
48</project>

Rename application.properties to application.yml, open the file, and add the following database configuration.

1# src/main/resources/application.yml
2
3spring:
4  datasource:
5    url: jdbc:postgresql://localhost:5432/spring
6    username: erin
7    password: richards

Create an API

Say, you want to save a Book object, described by the following entity.

 1// src/main/java/dev/mflash/guides/resterror/domain/Book.java
 2
 3public class Book {
 4
 5  private @Id long id;
 6  private String title;
 7  private String author;
 8  private Genre genre;
 9
10  // getters, setters, etc.
11}

The id will be of type SERIAL in Postgres which will be automatically incremented by the database.

Create the required table using the following SQL statement.

1CREATE TABLE book (
2	id SERIAL PRIMARY KEY,
3	title TEXT NOT NULL,
4	author TEXT NOT NULL,
5	genre TEXT NOT NULL
6);

Note that the genre field is backed by an enum described as follows.

1public enum Genre {
2  fantasy,
3  thriller,
4  scifi
5}

Define a BookRepository to perform database operations.

1// src/main/java/dev/mflash/guides/resterror/persistence/BookRepository.java
2
3public interface BookRepository extends CrudRepository<Book, Long> {
4
5}

Create a BookController to expose some endpoints.

 1// src/main/java/dev/mflash/guides/resterror/controller/BookController.java
 2
 3@RequestMapping("/book")
 4public @RestController class BookController {
 5
 6  private final BookRepository repository;
 7
 8  public BookController(BookRepository repository) {
 9    this.repository = repository;
10  }
11
12  @PutMapping
13  public Map<String, String> addBook(Book newBook) {
14    repository.save(newBook);
15    return Map.of("message", String.format("Save successful for %s", newBook.getTitle()));
16  }
17
18  @GetMapping
19  public List<Book> getAllBooks() {
20    List<Book> allBooks = List.of();
21    repository.findAll().forEach(allBooks::add);
22    return allBooks;
23  }
24
25  @GetMapping("/{id}")
26  public Book getBookById(@PathVariable long id) {
27    Optional<Book> book = repository.findById(id);
28
29    if (book.isEmpty()) {
30      throw new DataAccessResourceFailureException(String.format("No resource found for id (%s)", id));
31    }
32
33    return book.get();
34  }
35
36  @PatchMapping("/{id}")
37  public Map<String, String> editBook(@PathVariable long id, Book editedBook) {
38    final Optional<Book> saved = repository.findById(id);
39
40    if (saved.isPresent()) {
41      final Book savedBook = saved.get();
42      final Book patchedBook = new Book();
43      patchedBook.setId(savedBook.getId());
44      patchedBook.setTitle(
45          !editedBook.getTitle().equals(savedBook.getTitle()) ? editedBook.getTitle() : savedBook.getTitle());
46      patchedBook.setAuthor(
47          !editedBook.getAuthor().equals(savedBook.getAuthor()) ? editedBook.getAuthor() : savedBook.getAuthor());
48      patchedBook.setGenre(
49          !editedBook.getGenre().equals(savedBook.getGenre()) ? editedBook.getGenre() : savedBook.getGenre());
50      repository.save(patchedBook);
51    } else {
52      throw new InvalidDataAccessApiUsageException("Couldn't patch unrelated or non-existent records");
53    }
54
55    return Map.of("message", String.format("Patch successful for %s", editedBook.getTitle()));
56  }
57
58  @DeleteMapping("/{id}")
59  public Map<String, String> deleteBook(@PathVariable long id) {
60    if (repository.deleteById(id) < 1) {
61      throw new InvalidDataAccessApiUsageException("Couldn't delete a non-existent record");
62    }
63
64    return Map.of("message", String.format("Deletion successful for book with id: %s", id));
65  }
66}

Launch the application and try to access a non-existent book.

1$ curl --location --request GET 'http://localhost:8080/book/0'
2{
3  "timestamp": "2020-07-25T15:54:09.567+00:00",
4  "status": 500,
5  "error": "Internal Server Error",
6  "message": "",
7  "path": "/book/0"
8}

The operation failed, obviously, and you received a JSON response with some useful fields. These fields are managed by DefaultErrorAttributes class and the response is formed by an implementation of HandlerExceptionResolver. However, we can already see what is amiss here.

• There is no message clarifying what exactly went wrong.
• It is the client that passed the incorrect id but the status code indicates it is a server error.
• Since the record was not found, a 404 Not found would've been the accurate status.

Send the correct status using ResponseStatusException

The fastest way to address the issue with status is to throw Spring provided ResponseStatusException which accepts an HttpStatus.

 1// src/main/java/dev/mflash/guides/resterror/controller/BookController.java
 2
 3@RequestMapping("/book")
 4public @RestController class BookController {
 5
 6  // Rest of the controller
 7
 8  @GetMapping("/{id}")
 9  public Book getBookById(@PathVariable long id) {
10    Optional<Book> book = repository.findById(id);
11
12    if (book.isEmpty()) {
13      throw new ResponseStatusException(NOT_FOUND, String.format("No resource found for id (%s)", id));
14    }
15
16    return book.get();
17  }
18
19  @PatchMapping("/{id}")
20  public Map<String, String> editBook(@PathVariable long id, Book editedBook) {
21    final Optional<Book> saved = repository.findById(id);
22
23    if (saved.isPresent()) {
24      // logic for patch
25    } else {
26      throw new ResponseStatusException(INTERNAL_SERVER_ERROR, "Couldn't patch unrelated or non-existent records");
27    }
28
29    return Map.of("message", String.format("Patch successful for %s", editedBook.getTitle()));
30  }
31
32  @DeleteMapping("/{id}")
33  public Map<String, String> deleteBook(@PathVariable long id) {
34    if (repository.deleteById(id) < 1) {
35      throw new ResponseStatusException(INTERNAL_SERVER_ERROR, "Couldn't delete a non-existent record");
36    }
37
38    return Map.of("message", String.format("Deletion successful for book with id: %s", id));
39  }
40}

Launch the application and try the request again.

1$ curl --location --request GET 'http://localhost:8080/book/0'
2{
3  "timestamp": "2020-07-26T07:07:30.313+00:00",
4  "status": 404,
5  "error": "Not Found",
6  "message": "",
7  "path": "/book/0"
8}

We are getting the correct status now but it'd be useful to let the client know the cause of this issue. Also, it'd be useful to throw relevant custom exceptions instead of the same exception everywhere.

Exception handling with @ControllerAdvice and @ExceptionHandler

If you examine ResponseStatusException, you'd notice that it saves the message in a variable reason. We'd prefer to map this to the message key in the response above. Let's create a class RestResponse that can hold this response.

 1// src/main/java/dev/mflash/guides/resterror/exception/RestResponse.java
 2
 3public class RestResponse {
 4
 5  private final LocalDateTime timestamp = LocalDateTime.now();
 6  private int status;
 7  private String error;
 8  private String message;
 9  private String path;
10
11  // getters, setters, etc.
12
13  public static RestResponseBuilder builder() {
14    return new RestResponseBuilder();
15  }
16}

Let's also create a RestResponseBuilder that can provide a fluent API to create RestResponse objects from a variety of inputs.

 1// src/main/java/dev/mflash/guides/resterror/exception/RestResponseBuilder.java
 2
 3public class RestResponseBuilder {
 4
 5  private int status;
 6  private String error;
 7  private String message;
 8  private String path;
 9
10  public RestResponseBuilder status(int status) {
11    this.status = status;
12    return this;
13  }
14
15  public RestResponseBuilder status(HttpStatus status) {
16    this.status = status.value();
17
18    if (status.isError()) {
19      this.error = status.getReasonPhrase();
20    }
21
22    return this;
23  }
24
25  public RestResponseBuilder error(String error) {
26    this.error = error;
27    return this;
28  }
29
30  public RestResponseBuilder exception(ResponseStatusException exception) {
31    HttpStatus status = exception.getStatus();
32    this.status = status.value();
33    
34    if (!Objects.requireNonNull(exception.getReason()).isBlank()) {
35      this.message = exception.getReason();
36    }
37    
38
39    if (status.isError()) {
40      this.error = status.getReasonPhrase();
41    }
42
43    return this;
44  }
45
46  public RestResponseBuilder message(String message) {
47    this.message = message;
48    return this;
49  }
50
51  public RestResponseBuilder path(String path) {
52    this.path = path;
53    return this;
54  }
55
56  public RestResponse build() {
57    RestResponse response = new RestResponse();
58    response.setStatus(status);
59    response.setError(error);
60    response.setMessage(message);
61    response.setPath(path);
62    return response;
63  }
64
65  public ResponseEntity<RestResponse> entity() {
66    return ResponseEntity.status(status).headers(HttpHeaders.EMPTY).body(build());
67  }
68}

We can configure a @ControllerAdvice that can trigger methods to handle ResponseStatusException. This method has to be annotated by @ExceptionHandler which specifies what type of exceptions a method can handle.

 1// src/main/java/dev/mflash/guides/resterror/exception/RestErrorHandler.java
 2
 3@RestControllerAdvice
 4public class RestErrorHandler {
 5
 6  private static final Logger logger = LoggerFactory.getLogger(RestErrorHandler.class);
 7
 8  @ExceptionHandler(ResponseStatusException.class)
 9  ResponseEntity<?> handleStatusException(ResponseStatusException ex, WebRequest request) {
10    logger.error(ex.getReason(), ex);
11    return RestResponse.builder()
12        .exception(ex)
13        .path(request.getDescription(false).substring(4))
14        .entity();
15  }
16}

In the above codeblock, handleStatusException will be invoked whenever a ResponseStatusException is thrown and instead of the boilerplate Spring response, an instance of RestResponse would be returned with the reason.

1$ curl --location --request GET 'http://localhost:8080/book/0'
2{
3  "timestamp": "2020-07-26T15:24:38.0644948",
4  "status": 404,
5  "error": "Not Found",
6  "message": "No resource found for id (0)",
7  "path": "/book/0"
8}

Note that we're also injecting a WebRequest instance to get the path. Besides path, a WebRequest can provide a whole lot of other details about the request and client. Also, you may want to log the exceptions in the handler method, else Spring will not print them on the logs.

At this point, you may continue to throw ResponseStatusException throughout your application or you can choose to extend it to define custom exceptions with specific HttpStatus. But what about exceptions that are thrown by a third-party?

Handling Exceptions thrown by a third-party

One approach is to rethrow such exceptions as ResponseStatusException; this can be done wherever you encounter them. Another way is to write handler methods to intercept them in the @RestControllerAdvice above. It makes things a bit cleaner, but you can't handle every exception out there. To deal with this, you can write a generic exception handler that may handle Exception class.

To get you started, Spring offers a ResponseEntityExceptionHandler class that provides a huge number of handlers for the exceptions thrown by Spring. You can extend this class and implement your handlers on top of it. Even better, you can override the existing handlers to customize their behavior. Let's modify RestErrorHandler as follows.

 1// src/main/java/dev/mflash/guides/resterror/exception/RestErrorHandler.java
 2
 3@RestControllerAdvice
 4public class RestErrorHandler extends ResponseEntityExceptionHandler {
 5
 6  private static final Logger logger = LoggerFactory.getLogger(RestErrorHandler.class);
 7
 8  @ExceptionHandler(ResponseStatusException.class)
 9  ResponseEntity<?> handleStatusException(ResponseStatusException ex, WebRequest request) {
10    logger.error(ex.getReason(), ex);
11    return handleResponseStatusException(ex, request);
12  }
13
14  @ExceptionHandler(Exception.class)
15  ResponseEntity<?> handleAllExceptions(Exception ex, WebRequest request) {
16    logger.error(ex.getLocalizedMessage(), ex);
17    return handleEveryException(ex, request);
18  }
19
20  @SuppressWarnings("unchecked")
21  protected @Override ResponseEntity<Object> handleExceptionInternal(Exception ex, Object body, HttpHeaders headers,
22      HttpStatus status, WebRequest request) {
23
24    ResponseEntity<?> responseEntity;
25
26    if (!status.isError()) {
27      responseEntity = handleStatusException(ex, status, request);
28    } else if (INTERNAL_SERVER_ERROR.equals(status)) {
29      request.setAttribute("javax.servlet.error.exception", ex, 0);
30      responseEntity = handleEveryException(ex, request);
31    } else {
32      responseEntity = handleEveryException(ex, request);
33    }
34
35    return (ResponseEntity<Object>) responseEntity;
36  }
37
38  protected ResponseEntity<RestResponse> handleResponseStatusException(ResponseStatusException ex, WebRequest request) {
39    return RestResponse.builder()
40        .exception(ex)
41        .path(getPath(request))
42        .entity();
43  }
44
45  protected ResponseEntity<RestResponse> handleStatusException(Exception ex, HttpStatus status, WebRequest request) {
46    return RestResponse.builder()
47        .status(status)
48        .message("Execution halted")
49        .path(getPath(request))
50        .entity();
51  }
52
53  protected ResponseEntity<RestResponse> handleEveryException(Exception ex, WebRequest request) {
54    return RestResponse.builder()
55        .status(INTERNAL_SERVER_ERROR)
56        .message("Server encountered an error")
57        .path(getPath(request))
58        .entity();
59  }
60
61  private String getPath(WebRequest request) {
62    return request.getDescription(false).substring(4);
63  }
64}

A lot of things are going on here.

• handleResponseStatusException method specifically handles ResponseStatusException
• handleStatusException method handles exceptions when the status is not an error status (the statuses in 1xx, 2xx and 3xx series)
• handleEveryException method handles all other exceptions and sets their status as 500 Internal Server Error
• we're also overriding handleExceptionInternal to translate the exceptions thrown by Spring to return RestResponse
• finally, we've defined handleAllExceptions handler that serves as a catch-all. If no specific error handler is found for an exception, this method will be invoked.

To test this, launch the application and try to put a new book with genre as kids.

 1$ curl --location --request PUT 'http://localhost:8080/book' \
 2--header 'Content-Type: application/json' \
 3--data-raw '{
 4  "title": "The Land of Roar",
 5  "author": "Jenny McLachlan",
 6  "genre": "kids"
 7}'
 8
 9{
10  "timestamp": "2020-07-26T16:30:51.3444858",
11  "status": 500,
12  "error": "Internal Server Error",
13  "message": "Server encountered an error",
14  "path": "/book"
15}

Since we've not configured any constant named kids in the Genre enum, Jackson will serialize the genre field as null which would violate NOT NULL constraint in the database. The application will throw a DataAccessException as a result. Since there's no handler defined for this exception in RestErrorHandler class, the handleAllExceptions handler method will be invoked, sending the response seen above.

Error Handling for Spring Security

What happens if you add Spring Security in our application? After adding the JWT-based authentication (from the post Securing Spring Boot APIs with JWT Authentication) in our application, try to hit any BookController endpoint.

1$ curl --location --request GET 'http://localhost:8080/book'
2{
3  "timestamp": "2020-07-26T11:36:58.225+00:00",
4  "status": 403,
5  "error": "Forbidden",
6  "message": "",
7  "path": "/book"
8}

You'd notice that the exception handler that we configured earlier is not being invoked and we're getting the default response. This happens because our custom advice is invoked after Spring Security's servlet filters have verified the user. Since the user authentication failed, the handlers were never invoked.

Handle Authentication failure with AuthenticationEntryPoint

AuthenticationEntryPoint's commence method is called when an AuthenticationException is thrown. You can implement this interface to return a customized response.

 1// src/main/java/dev/mflash/guides/resterror/security/CustomAuthenticationEntryPoint.java
 2
 3public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {
 4
 5  private static final Logger logger = LoggerFactory.getLogger(CustomAuthenticationEntryPoint.class);
 6
 7  public @Override void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e)
 8      throws IOException {
 9    logger.error(e.getLocalizedMessage(), e);
10
11    String message = RestResponse.builder()
12        .status(UNAUTHORIZED)
13        .error("Unauthenticated")
14        .message("Insufficient authentication details")
15        .path(request.getRequestURI())
16        .json();
17
18    response.setStatus(UNAUTHORIZED.value());
19    response.setContentType(APPLICATION_JSON_VALUE);
20    response.getWriter().write(message);
21  }
22}

You can be as generic or versatile in handling different types of AuthenticationExceptions as you need. Configure this entrypoint in the security configuration as follows.

 1// src/main/java/dev/mflash/guides/resterror/security/SecurityConfiguration.java
 2
 3@EnableWebSecurity
 4public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 5
 6  private static final String LOGIN_URL = "/user/login";
 7  private final CustomUserDetailsService userDetailsService;
 8
 9  public SecurityConfiguration(CustomUserDetailsService userDetailsService) {
10    this.userDetailsService = userDetailsService;
11  }
12
13  protected @Override void configure(HttpSecurity http) throws Exception {
14    http.cors().and()
15        .csrf().disable()
16        .authorizeRequests().antMatchers(POST, REGISTRATION_URL).permitAll()
17        .anyRequest().authenticated().and()
18        .addFilter(new CustomAuthenticationFilter(authenticationManager()))
19        .exceptionHandling().authenticationEntryPoint(new CustomAuthenticationEntryPoint()).and()
20        .addFilter(new CustomAuthorizationFilter(authenticationManager()))
21        .sessionManagement().sessionCreationPolicy(STATELESS);
22  }
23
24  // other configurations
25}

Handle Authorization failure with AccessDeniedHandler

To handle authorization failures, you can implement the AccessDeniedHandler interface.

 1// src/main/java/dev/mflash/guides/resterror/security/CustomAccessDeniedHandler.java
 2
 3public class CustomAccessDeniedHandler implements AccessDeniedHandler {
 4
 5  private static final Logger logger = LoggerFactory.getLogger(CustomAccessDeniedHandler.class);
 6
 7  public @Override void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException e)
 8      throws IOException {
 9    logger.error(e.getLocalizedMessage(), e);
10
11    String message = RestResponse.builder()
12        .status(FORBIDDEN)
13        .message("Invalid Authorization token")
14        .path(request.getRequestURI())
15        .json();
16
17    response.setStatus(FORBIDDEN.value());
18    response.setContentType(APPLICATION_JSON_VALUE);
19    response.getWriter().write(message);
20  }
21}

Similar to the AuthenticationEntryPoint approach, you can handle different scenarios that can lead to authorization failure. Call the handle method implemented above whenever such scenarios are encountered. An example is given below.

 1// src/main/java/dev/mflash/guides/resterror/security/CustomAuthorizationFilter.java
 2
 3public class CustomAuthorizationFilter extends BasicAuthenticationFilter {
 4
 5  private final AccessDeniedHandler accessDeniedHandler;
 6
 7  public CustomAuthorizationFilter(AuthenticationManager authenticationManager, AccessDeniedHandler accessDeniedHandler) {
 8    super(authenticationManager);
 9    this.accessDeniedHandler = accessDeniedHandler;
10  }
11
12  protected @Override void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
13      throws IOException, ServletException {
14
15    String header = request.getHeader(AUTH_HEADER_KEY);
16
17    if (Objects.isNull(header) || !header.startsWith(TOKEN_PREFIX)) {
18      chain.doFilter(request, response);
19      return;
20    }
21
22    if (header.startsWith(TOKEN_PREFIX)) {
23      try {
24        var authentication = getAuthentication(header);
25        SecurityContextHolder.getContext().setAuthentication(authentication);
26        chain.doFilter(request, response);
27      } catch (Exception e) {
28        accessDeniedHandler.handle(request, response, new AccessDeniedException(e.getLocalizedMessage(), e));
29      }
30    }
31  }
32
33  private UsernamePasswordAuthenticationToken getAuthentication(String header) {
34
35    if (header.startsWith(TOKEN_PREFIX)) {
36      String username = parseToken(header);
37      return new UsernamePasswordAuthenticationToken(username, null, List.of());
38    } else {
39      throw new AccessDeniedException("Failed to parse authentication token");
40    }
41  }
42}

For this to work, you'll have to inject the CustomAccessDeniedHandler in CustomAuthorizationFilter through the security configuration, as follows.

 1// src/main/java/dev/mflash/guides/resterror/security/SecurityConfiguration.java
 2
 3@EnableWebSecurity
 4public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 5
 6  private static final String LOGIN_URL = "/user/login";
 7  private final CustomUserDetailsService userDetailsService;
 8
 9  public SecurityConfiguration(CustomUserDetailsService userDetailsService) {
10    this.userDetailsService = userDetailsService;
11  }
12
13  protected @Override void configure(HttpSecurity http) throws Exception {
14    http.cors().and()
15        .csrf().disable()
16        .authorizeRequests().antMatchers(POST, REGISTRATION_URL).permitAll()
17        .anyRequest().authenticated().and()
18        .addFilter(new CustomAuthenticationFilter(authenticationManager()))
19        .exceptionHandling().authenticationEntryPoint(new CustomAuthenticationEntryPoint()).and()
20        .addFilter(new CustomAuthorizationFilter(authenticationManager(), new CustomAccessDeniedHandler()))
21        .sessionManagement().sessionCreationPolicy(STATELESS);
22  }
23
24  // other configurations
25}

Launch the application again and try accessing an endpoint without any authentication details.

1$ curl --location --request GET 'http://localhost:8080/book'
2{
3  "timestamp": "2020-07-26T20:38:10.166004300",
4  "status": 401,
5  "error": "Unauthenticated",
6  "message": "Insufficient authentication details",
7  "path": "/book"
8}

A 401 Unauthenticated error was sent, informing that authentication details were not sufficient for this request. Now, add an expired Bearer token in an Authorization header and send the request again.

 1$ curl --location --request GET 'http://localhost:8080/book' \
 2--header 'Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJlbWlseS5icm9udGVAZXhhbXBsZS5jb20iLCJleHAiOjE1OTY1NTI0MTZ9.utTGxu-CTJglYQku9GMZPsOl-J8rni363nBaGbodNiP7D0J66Znf-fZZ-Hz_iVCO7CHj_s4E6Xuw68HCwyTZig'
 3
 4{
 5  "timestamp": "2020-07-26T20:57:27.164265300",
 6  "status": 403,
 7  "error": "Forbidden",
 8  "message": "Invalid Authorization token",
 9  "path": "/book"
10}

This time, a 403 Forbidden error was sent indicating that even though the authentication was successful, the token was invalid. Generate a new token by sending a login request.

1$ curl --location --request POST 'http://localhost:8080/login' \
2--header 'Content-Type: application/json' \
3--data-raw '{
4  "email": "arya.antrix@example.com",
5  "password": "pa55word"
6}'

You'll receive a response 200 OK with an Authorization header that contains a token.

Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJlbWlseS5icm9udGVAZXhhbXBsZS5jb20iLCJleHAiOjE1OTY2NDE0MjJ9.xK9KvbdlPN_r_rJzwfaidYY2r83pvGsXgIw8LQokvMbVXCyF9fZnV1CgnVc1pjQeswFq8rOGhmgEdCHp7DbR8w

Using this token, try sending the request again.

 1$ curl --location --request GET 'http://localhost:8080/book' \
 2--header 'Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJlbWlseS5icm9udGVAZXhhbXBsZS5jb20iLCJleHAiOjE1OTY2NDE0MjJ9.xK9KvbdlPN_r_rJzwfaidYY2r83pvGsXgIw8LQokvMbVXCyF9fZnV1CgnVc1pjQeswFq8rOGhmgEdCHp7DbR8w'
 3
 4[
 5  {
 6    "id": 1,
 7    "title": "Kill Orbit",
 8    "author": "Joel Dane",
 9    "genre": "scifi"
10  }
11]

You'll receive a 200 OK with a list of books saved in the database, as expected.

References

Source Code — spring-rest-error-handling

Related

• Securing Spring Boot APIs with JWT Authentication
• Spring Security: Authentication and Authorization In-Depth