Spring Boot: How to tell client that account password has expired? - spring-boot

Question

I have a simple login form and a login() method in a controller :
#PostMapping("/login")
public ResponseEntity<UserVO> login(#RequestBody UserVO userVO) {
Authentication authentication = authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(
userVO.getUsername(),
userVO.getPassword()
)
);
SecurityContextHolder.getContext().setAuthentication( authentication );
// ...
return ResponseEntity.ok( loggedInUser );
}
I have a users table with columns :
`username`
`password`
`password_expiration`
`account_expiration`
`account_locked`
`account_disabled`
When I set the value of column password_expiration to expire a user's password, Spring Boot's authenticationManager.authenticate() method throws an AccountExpiredException exception at next login attempt :
package org.springframework.security.authentication;
public class AccountExpiredException extends AccountStatusException {
public AccountExpiredException(String msg) {
super(msg);
}
public AccountExpiredException(String msg, Throwable t) {
super(msg, t);
}
}
and JSON response is :
{
"timestamp":"2018-07-26T22:53:05.392+0000",
"status":401,
"error":"Unauthorized",
"message":"Unauthorized",
"path":"/login"
}
I get the same JSON response (401 error code) whenever the password is wrong or one of the methods of UserVO (which in turn implements UserDetails) return false :
boolean isAccountNonExpired();
boolean isAccountNonLocked();
boolean isCredentialsNonExpired();
boolean isEnabled();
So far so good.
When the user logs in and his/her password is expired I want to redirect the UI to a mandatory password change page. But how ? I always get the same JSON respons.
1) Since the JSON output that is returned is always a HTTP 401 error, how can I get a more fine grained response ? (How to tell client code that the password has expired?)
2) Is it generally considered good or bad practice to inform the user that his/her account is locked / expired / disabled ? (good user experience vs giving away info about account state to hackers)

Answer 1

Maybe not the best solution, but I solved it by setting the "message" field :
#Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint, Serializable {
#Override
public void commence(HttpServletRequest request,
HttpServletResponse response,
AuthenticationException authException) throws IOException {
String message = "Unauthorized";
if ( authException instanceof BadCredentialsException )
message = AUTH_CREDENTIALS_BAD;
else if ( authException instanceof CredentialsExpiredException )
message = AUTH_CREDENTIALS_EXPIRED;
else if ( authException instanceof LockedException )
message = AUTH_ACCOUNT_LOCKED;
else if ( authException instanceof DisabledException )
message = AUTH_ACCOUNT_DISABLED;
else if ( authException instanceof AccountExpiredException )
message = AUTH_ACCOUNT_EXPIRED;
response.sendError( HttpServletResponse.SC_UNAUTHORIZED, message );
}
}
Now I get this as response :
{
"timestamp":"2018-07-27T12:54:53.097+0000",
"status":401,
"error":"Unauthorized",
"message":"credentials_expired",
"path":"/login"
}