From e8affab78affabb2bbf9776a1e2757a4eb7e4a0c Mon Sep 17 00:00:00 2001 From: xiose Date: Thu, 30 Apr 2026 10:20:10 +0800 Subject: [PATCH] fix(security): add invalidSessionStrategy to return 401 on expired session Handles the case where Spring Security detects an invalid session cookie, returning a clean 401 JSON response instead of triggering cascading exceptions. Closes #360 (part 1/2) --- .../com/iflytek/skillhub/auth/config/SecurityConfig.java | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/config/SecurityConfig.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/config/SecurityConfig.java index 085255ea..05b87025 100644 --- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/config/SecurityConfig.java +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/config/SecurityConfig.java @@ -9,10 +9,12 @@ import com.iflytek.skillhub.auth.mock.MockAuthFilter; import com.iflytek.skillhub.auth.policy.RouteSecurityPolicyRegistry; import com.iflytek.skillhub.auth.token.ApiTokenAuthenticationFilter; import com.iflytek.skillhub.auth.token.ApiTokenScopeFilter; +import jakarta.servlet.http.HttpServletResponse; import org.springframework.beans.factory.ObjectProvider; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpStatus; +import org.springframework.http.MediaType; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.AuthenticationEntryPoint; @@ -133,6 +135,11 @@ public class SecurityConfig { ) .sessionManagement(session -> session .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED) + .invalidSessionStrategy((request, response) -> { + response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); + response.setContentType(MediaType.APPLICATION_JSON_VALUE); + response.getWriter().write("{\"code\":401,\"msg\":\"Session expired\"}"); + }) ) .exceptionHandling(exceptions -> exceptions .accessDeniedHandler(apiAccessDeniedHandler)