LAB-005: Security Error Contract¶
Status: Verified for the stateless REST chain
Theory: Security Error Boundaries
Objective¶
Return stable JSON for missing authentication and insufficient authority without exposing exceptions, policies, authorities, tokens, or stack traces.
Implementation map¶
| Artifact | Purpose |
|---|---|
SecurityErrorResponse | Stable response schema |
JsonAuthenticationEntryPoint | HTTP 401 serialization |
JsonAccessDeniedHandler | HTTP 403 serialization |
MultiAuthSecurityConfig | Production handler registration |
RequestAuthorizationLabTest | Exact contract and non-disclosure assertions |
Exercises¶
- Request
/api/user/secureanonymously and inspect the entry-point response. - Request
/api/admin/secureas USER and inspect the denied-handler response. - Confirm JSON content type and stable machine codes.
- Confirm exception, authorities, and expression fields are absent.
- Compare filter-boundary handling with the controller login exception handler.
- Explain why a browser login chain may redirect instead of using this JSON contract.
Verification¶
Expected machine codes:
| Status | Code |
|---|---|
| 401 | authentication_required |
| 403 | access_denied |
Attack checks¶
- Ensure exception messages never become response content.
- Ensure paths cannot inject invalid JSON; serialization must use
ObjectMapper. - Ensure credentials and authorization details remain absent from logs and bodies.
Review¶
Complete the entry-point and denied-handler questions in the Spring Security Internals Quiz.
Next: LAB-006 Browser Sessions