...
| Bloque de código | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
3.1. Error Codes
When a request fails, the resource server responds using the
appropriate HTTP status code (typically, 400, 401, 403, or 405) and
includes one of the following error codes in the response:
invalid_request
The request is missing a required parameter, includes an
unsupported parameter or parameter value, repeats the same
parameter, uses more than one method for including an access
token, or is otherwise malformed. The resource server SHOULD
respond with the HTTP 400 (Bad Request) status code.
invalid_token
The access token provided is expired, revoked, malformed, or
invalid for other reasons. The resource SHOULD respond with
the HTTP 401 (Unauthorized) status code. The client MAY
request a new access token and retry the protected resource
request.
insufficient_scope
The request requires higher privileges than provided by the
access token. The resource server SHOULD respond with the HTTP
403 (Forbidden) status code and MAY include the "scope"
attribute with the scope necessary to access the protected
resource.
If the request lacks any authentication information (e.g., the client
was unaware that authentication is necessary or attempted using an
unsupported authentication method), the resource server SHOULD NOT
include an error code or other error information.
For example:
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="example" |
3. Documentar con Springdoc-OPENAPI
Utilizando @PreAuthorize es posible configurar la generación de la documentación para que aparezca el Scope requerido.
Para hacerlo solo sería necesario añadir una clase de configuración como ésta:
| Bloque de código | ||||
|---|---|---|---|---|
| ||||
@Configuration
public class OpenApiConfiguration {
@Bean
public OperationCustomizer operationCustomizer() {
return ( operation, handlerMethod ) -> {
Optional<PreAuthorize> preAuthorizeAnnotation = Optional
.ofNullable( handlerMethod.getMethodAnnotation( PreAuthorize.class ) );
StringBuilder sb = new StringBuilder();
if ( preAuthorizeAnnotation.isPresent() ) {
Pattern patternAuthority = Pattern.compile( "'SCOPE_\\w+'" );
Matcher matcher = patternAuthority.matcher( ( preAuthorizeAnnotation.get() ).value() );
if ( matcher.find() ) {
sb.append( "Este endpoint requiere: **SCOPE " ).append( matcher.group().replaceAll( "SCOPE_", "" ) )
.append( "**<br />" );
}
sb.append( "<br />" );
}
sb.append( operation.getDescription() );
operation.setDescription( sb.toString() );
return operation;
};
}
} |
El resultado de esta configuración se puede ver en la siguiente imagen:
Referencias
https://www.baeldung.com/spring-security-method-security
...