Description
Summary
BearerTokenAuthenticationFilter swallows the cause of exception during AuthenticationException DEBUG logging
Actual Behavior
Usecase to reproduce: Configure a JWK-SET-URI over HTTPS with self signed cert serving the keys.
Turn on DEBUG logging for org.springframework.security
Actual Behavior: with any given valid JWT token the resource will be Unauthorized, and the top level detailed message will be printed:
"Authentication request for failed: " + failed
if (debug) { this.logger.debug("Authentication request for failed: " + failed); }
In this case It would be an OAuth2AuthenticationException "Invalid Token", effectively swallowing the failed.getCause() throwable (SSL handshake ex: "PKIX path validation failed")
Expected Behavior
Should log the full stack trace in DEBUG level, in order to pinpoint any root cause exceptions.
Configuration
Version
5.2.x