Disable error message: AccessDeniedException: Access is denied

user_1103606 0
Viewed 99

I use this custom error handler:

@Component
public class OAuth2AuthenticationEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
                         AuthenticationException ex) throws IOException {

        ErrorDetail errorDetail = ErrorDetail.AUTHENTICATION_ERROR;

        ErrorResponse errorEntry = new ErrorResponse();
        errorEntry.setTitle(errorDetail.getTitle());
        errorEntry.setCode(errorDetail.getErrorCode());
        HttpStatus httpStatus = ErrorDetail.getHttpStatusBasedOnErrorCode(errorDetail.getErrorCode());
        errorEntry.setStatus(httpStatus.value());
        errorEntry.setDetail(ex.getMessage());
        Map<String, String> extra = new HashMap<String, String>();
        extra.put("detail", ex.getMessage());
        errorEntry.setExtra(extra);

        ErrorResponseDTO errorResponse = new ErrorResponseDTO();
        errorResponse.setErrors(Arrays.asList(errorEntry));

        response.setStatus(errorDetail.getHttpStatus().value());
        String json = new ObjectMapper().setDefaultPropertyInclusion(JsonInclude.Include.NON_NULL).writeValueAsString(errorResponse);
        response.getWriter().write(json);
        response.flushBuffer();
    }
}

I get this error response as it should be:

{"errors":[{"status":404,"code":"1000","title":"Authentication error","detail":"Full authentication is required to access this resource","extra":{"detail":"Full authentication is required to access this resource"}}]}

But I get into server log this error:

21:34:30.498 [http-nio-8090-exec-7] DEBUG AffirmativeBased[decide:66] - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@33252ffb, returned: -1
21:34:30.498 [http-nio-8090-exec-7] DEBUG ExceptionTranslationFilter[handleSpringSecurityException:180] - Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
        at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84)
        at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:123)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:90)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:118)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)

Do you know how I can suppress or disable this error every time when I get AuthenticationException?

spring-boot spring-security spring java
1 Answers

This is a DEBUG level log for development purposes which is okay. On the production level, the log level should not be lower than the WARN level so these exceptions will not be logged and it is not a concern.

If you insist to modify the behavior anyway, Spring allows setting a log level right on the class or disable it at all using OFF. I find turning it off as discouraged since you might miss more severe logs as such the exception can be logged also on the different levels.

Open application.properties and write one of:

  • Disable all logs: org.springframework.security.access.AccessDeniedException=OFF
  • At least ERROR level: org.springframework.security.access.AccessDeniedException=ERROR
  • At least WARN level: org.springframework.security.access.AccessDeniedException=WARN
user_37649650
Related