spring boot关于在进入controller层之前捕捉异常

问题

spring boot中使用全局异常捕捉器捕捉异常返回友好数据, 准确地说不应该叫做全局异常捕捉器, 因为@RestControllerAdvice定义的异常捕捉只能捕捉经过controller层的异常, 而进入controller层之前的异常, 比如进入controller层之前的过滤器中的异常, 无法被捕捉

那么如何捕捉进入controller层之前的异常?

场景

spring security + jwt安全权限框架

用户发起一个请求, 首先经过过滤器检验是否带token或token是否合法, 不合法就不从数据中加载用户数据, 合法就加载用户数据和权限到上下文中

// AuthenticationFilter
@Override
protected void doFilterInternal(@NonNull HttpServletRequest request, @NonNull HttpServletResponse response, @NonNull FilterChain filterChain) throws ServletException, IOException {
  String token = jwtUtil.getTokenFromRequest(request); // 从request中解析token
  // 没token的直接玩完
  if (StrUtil.isNotEmpty(token)) {
      // token过期的 或伪造 或多设备登录的 直接玩完
      String username = jwtUtil.getUsernameFromToken(token); // 从token中解析username
      if (StrUtil.isNotEmpty(username) && ObjectUtil.isNull(SecurityUtil.getCurrentAuthentication())) {
          // 合法, 用户加载信息
          UserDetails userDetails = userDetailsService.loadUserByUsername(username);
          UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null, null);
          SecurityUtil.getContext().setAuthentication(authenticationToken);
      }
  }
  filterChain.doFilter(request, response);
}

// jwtUtil
/**
 * 将token解析为Claims
 * @param token token
 * @throws TokenExpiredException         token过期
 * @throws IllegalTokenException         不合法的token
 * @throws OtherClientsLoggedInException 已在其它客户端登录
 */
public Claims parseToken(String token) {
    Claims claims;
    String username;
    try {
        claims = Jwts.parser()
                .setSigningKey(this.secret)
                .parseClaimsJws(token) // 解析token 抛出ExpiredJwtException, UnsupportedJwtException, MalformedJwtException, SignatureException, IllegalArgumentException捕捉后再抛出自定义的异常
                .getBody();
        username = claims.getSubject();
      
    } catch (ExpiredJwtException e) {
        log.error("JwtUtil - Token 已过期");
        throw new TokenExpiredException("token已过期");
    } catch (UnsupportedJwtException e) {
        log.error("JwtUtil - 不支持的token");
        throw new IllegalTokenException("不支持的token");
    } catch (MalformedJwtException e) {
        log.error("JwtUtil - token无效");
        throw new IllegalTokenException("token无效");
    } catch (SignatureException e) {
        log.error("JwtUtil - 无效的token签名");
        throw new IllegalTokenException("无效的token签名");
    } catch (IllegalArgumentException e) {
        log.error("JwtUtil - token参数不存在");
        throw new IllegalTokenException("JwtUtil - token参数不存在");
    }

    String redisKey = this.redisTokenPrefix + username;
    if (redisService.isExpired(redisKey)) {
        log.error("JwtUtil - redis中的token已过期");
        throw new TokenExpiredException("token已过期");
    }
    // 检验redis中的token是否与当前一致, 不一致则代表用户已注销/用户在不同设备登录，均代表JWT已过期
    String redisToken = redisService.get(redisKey);
    if (!StrUtil.equals(token, redisToken)) {
        log.error("JwtUtil - redis中的token不一致");
        throw new OtherClientsLoggedInException("已在其它客户端登录, 请重新登录");
    }
    return claims;
}

/**
 * 从token中解析username
 */
public String getUsernameFromToken(String token) {
    Claims claims = parseToken(token);
    return claims.getSubject();
}

// GlobalExceptionHandler 全局异常处理
@Slf4j
@RestControllerAdvice
public class GlobalExceptionHandler {
    @ExceptionHandler(IllegalTokenException.class)
    public Dict IllegalTokenException(HttpServletRequest request, HttpServletResponse response, IllegalTokenException e) {
        log.error("GlobalExceptionHandler - IllegalTokenException - {}", e.getMessage());
        return Result.illegalToken(e.getMessage());
    }

    @ExceptionHandler(TokenExpiredException.class)
    public Dict tokenExpiredException(HttpServletRequest request, HttpServletResponse response,TokenExpiredException e) {
        log.error("GlobalExceptionHandler - TokenExpiredException - {}", e.getMessage());
        return Result.tokenExpired(e.getMessage());
    }

    @ExceptionHandler(OtherClientsLoggedInException.class)
    public Dict otherClientsLoggedInException(HttpServletRequest request, HttpServletResponse response,OtherClientsLoggedInException e) {
        log.error("GlobalExceptionHandler - OtherClientsLoggedInException - {}", e.getMessage());
        return Result.otherClientsLoggedIn(e.getMessage());
}

全局异常处理返回友好数据, 其中Result是封装HuTool的Dict字典类作为统一返回对象

使用不合法的token发起一次请求

---

图1 构造无效的token发起请求

---

根据图1可以看到, 抛出了异常, 但GlobalExceptionHandler未能正确捕捉异常返回友好数据

解决

可行的做法一^[1]

(推荐)在过滤器中捕捉异常并直接利用response返回结果

// AuthenticationFilter
@Override
protected void doFilterInternal(@NonNull HttpServletRequest request, @NonNull HttpServletResponse response, @NonNull FilterChain filterChain) throws ServletException, IOException {
    String token = jwtUtil.getTokenFromRequest(request);
    // 没token的直接玩完
    if (StrUtil.isNotEmpty(token)) {
        // token过期的 或伪造 或多设备登录的 直接玩完
        String username;
        try {
            // filter中的异常, GlobalExceptionHandler无法捕捉, 转发到ExceptionController中进行统一返回
            username = jwtUtil.getUsernameFromToken(token);
        } catch (Exception e) {
            response.setHeader("Access-Control-Allow-Origin", "*");
            response.setHeader("Access-Control-Allow-Methods", "*");
            response.setContentType("application/json;charset=UTF-8");
            response.setStatus(200);
            // 将Dict对象转化为JSON字符串写入response
            if (e instanceof TokenExpiredException) {
                // 调用统一封装对象的tokenExpired()
                response.getWriter()
                        .write(JSONUtil.toJsonStr(Result.tokenExpired(e.getMessage())));
            } else if (e instanceof IllegalTokenException) {
                // 调用统一封装对象的illegalToken()
                response.getWriter()
                        .write(JSONUtil.toJsonStr(Result.illegalToken(e.getMessage())));
            } else if (e instanceof OtherClientsLoggedInException) {
                // 调用统一封装对象的otherClientsLoggedIn()
                response.getWriter()
                        .write(JSONUtil.toJsonStr(Result.otherClientsLoggedIn(e.getMessage())));
            }else{
                response.getWriter()
                        .write(JSONUtil.toJsonStr(Result.forbidden(e.getMessage())));
            }
            return;
        }
        if (StrUtil.isNotEmpty(username) && ObjectUtil.isNull(SecurityUtil.getCurrentAuthentication())) {
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null, null);
            SecurityUtil.getContext().setAuthentication(authenticationToken);
        }
    }
    filterChain.doFilter(request, response);   
}

---

图2 构造无效token发起请求

---

可以看到, 这种方法行得通, 返回了自定义的封装结果

可行的做法二^[2]

在过滤器中捕捉异常, 利用request的转发, 转发到特定的controller进行异常的返回

创建专门返回异常的controller

// ExceptionController
@RestController
@RequestMapping("/exception")
public class ExceptionController {
    @RequestMapping("/token-expired-exception")
    public Dict tokenExpiredException(HttpServletRequest request) {
        String msg = (String) request.getAttribute("msg");
        return Result.tokenExpired(msg);
    }

    @RequestMapping("/illegal-token-exception")
    public Dict illegalTokenException(HttpServletRequest request) {
        String msg = (String) request.getAttribute("msg");
        return Result.illegalToken(msg);
    }

    @RequestMapping("/other-clients-logged-in-exception")
    public Dict otherClientsLoggedInException(HttpServletRequest request) {
        String msg = (String) request.getAttribute("msg");
        return Result.otherClientsLoggedIn(msg);
    }

    @RequestMapping("/access-denied-exception")
    public Dict accessDeniedException(HttpServletRequest request) {
        String msg = (String) request.getAttribute("msg");
        return Result.forbidden(msg);
    }

    @RequestMapping("/authentication-entry-point-exception")
    public Dict authenticationEntryPoint(HttpServletRequest request) {
        String msg = (String) request.getAttribute("msg");
        return Result.forbidden(msg);
    }

    @RequestMapping("/error")
    public Dict error(HttpServletRequest request) {
        String msg = (String) request.getAttribute("msg");
        return Result.otherClientsLoggedIn(msg);
    }
}

// Authentication
@Override
protected void doFilterInternal(@NonNull HttpServletRequest request, @NonNull HttpServletResponse response, @NonNull FilterChain filterChain) throws ServletException, IOException {
    String token = jwtUtil.getTokenFromRequest(request);
    // 没token的直接玩完
    if (StrUtil.isNotEmpty(token)) {
        // token过期的 或伪造 或多设备登录的 直接玩完
        String username = null;
        try {
            // filter中的异常, GlobalExceptionHandler无法捕捉, 转发到ExceptionController中进行统一返回
            username = jwtUtil.getUsernameFromToken(token);
        } catch (Exception e) {
            request.setAttribute("msg", e.getMessage()); // 设置异常信息
            String url;
            if (e instanceof TokenExpiredException) {
                url = "/exception/token-expired-exception";
            } else if (e instanceof IllegalTokenException) {
                url = "/exception/illegal-token-exception";
            } else if (e instanceof OtherClientsLoggedInException) {
                url = "/exception/other-clients-logged-in-exception";
            } else {
                url = "/exception/error";
            }
            request.getRequestDispatcher(url).forward(request, response);
            return;
        }
        if (StrUtil.isNotEmpty(username) && ObjectUtil.isNull(SecurityUtil.getCurrentAuthentication())) {
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null, null);
            SecurityUtil.getContext().setAuthentication(authenticationToken);
        }
    }
    filterChain.doFilter(request, response);
}

---

图3 构造无效token发起请求

---

这种方法虽然可以catch到异常后转发到专门的controller中方便管理, 但有时候会直接跳过request.getRequestDispatcher(url).forward(request, response);
并不会进行转发, 但有时也能正常转发, 很让人头疼

方法一可以在catch到异常后准确地将异常信息发送到浏览器

参考

[1]. SpringBoot统一异常拦截处理(filter中的异常无法被拦截处理)
[2]. SpringBoot全局异常处理捕获Filter内部异常