Package com.alpaca.security.oauth2

Class AuthFailureHandler

java.lang.Object
org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler
com.alpaca.security.oauth2.AuthFailureHandler
All Implemented Interfaces:
org.springframework.security.web.authentication.AuthenticationFailureHandler
@Component public class AuthFailureHandler extends org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler
Custom authentication failure handler for OAuth2 login flows.

When authentication fails, this handler:

  • Removes cookies used during the OAuth2 authorization request (via CookieAuthReqRepo).
  • Determines an appropriate redirect URL, falling back to a configured frontend URI as needed.
  • Appends an `error` query parameter to the redirect target—with sanitized message content—to inform the client of the failure.
  • Redirects the client to the resulting URL using Spring Security’s redirection strategy.

This approach helps protect against open redirects by limiting fallback locations and sanitizes error messages to mitigate injection-like risks.

See Also:

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private static final Pattern
    ERROR_SANITIZER
     
    private final String
    frontendUri
     
    private final CookieAuthReqRepo
    repository
     

    Fields inherited from class org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler

    logger

  • Constructor Summary

    Constructors
    Constructor
    Description
    AuthFailureHandler(CookieAuthReqRepo repository, @NotNull String frontendUri)
    Constructs the handler with required dependencies.

  • Method Summary

    Modifier and Type
    Method
    Description
    private String
    appendErrorParam(String base, String rawError)
    Appends a sanitized "error" query parameter to the base URL.
    void
    onAuthenticationFailure(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.AuthenticationException exception)
     
    private String
    resolveTargetUrl(jakarta.servlet.http.HttpServletRequest request)
    Determines the target URL for redirection after failure.

    Methods inherited from class org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler

    getRedirectStrategy, isAllowSessionCreation, isUseForward, saveException, setAllowSessionCreation, setDefaultFailureUrl, setRedirectStrategy, setUseForward

    Methods inherited from class java.lang.Object

    clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • repository

      private final CookieAuthReqRepo repository

    • frontendUri

      private final String frontendUri

    • ERROR_SANITIZER

      private static final Pattern ERROR_SANITIZER

  • Constructor Details

    • AuthFailureHandler

      public AuthFailureHandler(CookieAuthReqRepo repository, @Value("${app.frontendURI}") @NotNull @NotNull String frontendUri)
      Constructs the handler with required dependencies.
      Parameters:
      repository - the repository for handling OAuth2 auth request cookies
      frontendUri - the default frontend URI to redirect to upon failure

  • Method Details

    • onAuthenticationFailure

      public void onAuthenticationFailure(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.AuthenticationException exception) throws IOException
      Specified by:
      onAuthenticationFailure in interface org.springframework.security.web.authentication.AuthenticationFailureHandler
      Overrides:
      onAuthenticationFailure in class org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler
      Throws:
      IOException

    • resolveTargetUrl

      private String resolveTargetUrl(jakarta.servlet.http.HttpServletRequest request)
      Determines the target URL for redirection after failure. Prefers the "redirect_uri" request parameter or cookie, and falls back to frontendUri.
      Parameters:
      request - the incoming HTTP request
      Returns:
      the redirection URL

    • appendErrorParam

      private String appendErrorParam(String base, String rawError)
      Appends a sanitized "error" query parameter to the base URL. Removes potentially harmful characters from the error message.
      Parameters:
      base - the base redirect URL
      rawError - the original error message
      Returns:
      the sanitized URL