Add URL to RequestRejectedException when rejecting requests

[PatrickGotthard]

Summary

When a request gets rejected by the StrictHttpFirewall the URL will not be logged. So it's very hard to find out which client, frontend or else caused the issue.

Actual Behavior

When a request gets rejected by the StrictHttpFirewall the error message only states why a request was blocked but not which URL was called.

Expected Behavior

When a request gets blocked by the StrictHttpFirewall the exception should contain the URL which was called.

Version

spring-security-web 5.0.3.RELEASE

[rwinch]

Thanks for the report. Is there a reason the server cares? I would think that the client would need to change behavior so it would know what request caused the error.

[PatrickGotthard]

Hi @rwinch,

my application is a monolith consisting of a REST backend with a few hundred REST endpoints and an ExtJS frontend. Since upgrading to Spring Boot 2 the application logged some RequestRejectedExceptions but I had no idea what caused the problem. Unfortunately the end users don't report every problem ;)

In the meantime I've installed a custom ServletFilter that logs the RequestRejectedExceptions together with the called URL but I think that Spring Security itself should log enough information to be able to analyze such exceptions.

Regards,
Patrick

[rwinch]

Thanks for the additional information. I'm going to log this as a duplicate of #5007 which is already asking for an improved way to handle the RequestRejectedException

[PatrickGotthard]

Did you mean #5007 ? :)

[rwinch]

Thanks updated my comment to make it easier to follow along