Merge pull request #51 from jimmyjames/add-www-authenticate-header

Add WWW-Authenticate header for 401 and 403 requests

lib/src/main/java/com/auth0/spring/security/api/JwtAccessDeniedHandler.java

@@ -0,0 +1,22 @@
+package com.auth0.spring.security.api;
+
+import org.springframework.http.HttpHeaders;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.web.access.AccessDeniedHandlerImpl;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * Custom handler for access denied exceptions.
+ */
+class JwtAccessDeniedHandler extends AccessDeniedHandlerImpl {
+
+    @Override
+    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
+        response.addHeader(HttpHeaders.WWW_AUTHENTICATE, "Bearer error=\"Insufficient scope\"");
+        super.handle(request, response, accessDeniedException);
+    }
+}

lib/src/main/java/com/auth0/spring/security/api/JwtAuthenticationEntryPoint.java

@@ -1,5 +1,6 @@
 package com.auth0.spring.security.api;
 
+import org.springframework.http.HttpHeaders;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;
 
@@ -9,8 +10,14 @@
 import java.io.IOException;
 
 public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {
+
     @Override
     public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
+        response.addHeader(
+                HttpHeaders.WWW_AUTHENTICATE,
+                "Bearer error=\"Invalid access token\""
+        );
+
         response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
     }
 }

lib/src/main/java/com/auth0/spring/security/api/JwtWebSecurityConfigurer.java

@@ -103,6 +103,7 @@ public HttpSecurity configure(HttpSecurity http) throws Exception {
                 .and()
                 .exceptionHandling()
                 .authenticationEntryPoint(new JwtAuthenticationEntryPoint())
+                .accessDeniedHandler(new JwtAccessDeniedHandler())
                 .and()
                 .httpBasic().disable()
                 .csrf().disable()

lib/src/test/java/com/auth0/spring/security/api/JwtAccessDeniedHandlerTest.java

@@ -0,0 +1,28 @@
+package com.auth0.spring.security.api;
+
+import org.junit.Test;
+import org.springframework.security.access.AccessDeniedException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+public class JwtAccessDeniedHandlerTest {
+
+    @Test
+    public void shouldReturnForbidden() throws Exception {
+        JwtAccessDeniedHandler handler = new JwtAccessDeniedHandler();
+        HttpServletRequest request = mock(HttpServletRequest.class);
+        HttpServletResponse response = mock(HttpServletResponse.class);
+        AccessDeniedException exception = new AccessDeniedException("Forbidden");
+
+        handler.handle(request, response, exception);
+        verify(response).addHeader(
+                "WWW-Authenticate",
+                "Bearer error=\"Insufficient scope\""
+        );
+        verify(response).sendError(403, "Forbidden");
+    }
+}

lib/src/test/java/com/auth0/spring/security/api/JwtAuthenticationEntryPointTest.java

@@ -19,7 +19,10 @@ public void shouldReturnUnauthorized() throws Exception {
         AuthenticationException exception = mock(AuthenticationException.class);
 
         entryPoint.commence(request, response, exception);
+        verify(response).addHeader(
+                "WWW-Authenticate",
+                "Bearer error=\"Invalid access token\""
+        );
         verify(response).sendError(401, "Unauthorized");
     }
-
 }