Package org.mockserver.authentication

Class AuthenticationException

java.lang.Object

java.lang.Throwable

java.lang.Exception

java.lang.RuntimeException

org.mockserver.authentication.AuthenticationException

All Implemented Interfaces:

Serializable

Direct Known Subclasses:

JWTAuthenticationException, JWTKeyNotFoundAuthenticationException

public class AuthenticationException
extends RuntimeException

See Also:

• Serialized Form

Constructor Summary

Constructors

Constructor	Description
AuthenticationException(String message)
AuthenticationException(String message, boolean clientSafeMessage)
AuthenticationException(String message, Throwable throwable)
AuthenticationException(String message, Throwable throwable, boolean clientSafeMessage)

Method Summary

Modifier and Type	Method	Description
boolean	isClientSafeMessage()	Whether the exception message is safe to echo to the (unauthenticated) client in the 401 response body.

Methods inherited from class java.lang.Throwable

addSuppressed, fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, getSuppressed, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Details

AuthenticationException

public AuthenticationException(String message)

AuthenticationException

public AuthenticationException(String message,
 Throwable throwable)

AuthenticationException

public AuthenticationException(String message,
 boolean clientSafeMessage)

AuthenticationException

public AuthenticationException(String message,
 Throwable throwable,
 boolean clientSafeMessage)

Method Details

isClientSafeMessage

public boolean isClientSafeMessage()

Whether the exception message is safe to echo to the (unauthenticated) client in the 401 response body. Legacy JWT / mTLS handlers return true (their detailed message has always been surfaced to the client). The OIDC handler returns false so the detail (expected issuer, audience, required scopes, signature reasons) is logged SERVER-SIDE only and the client receives a generic body.