Spring Security 5.1+内置了对JWT的支持。
您可以配置Spring Security来查找JWT，而不是连接您自己的自定义过滤器：

http
    // ...
    .oauth2ResourceServer((oauth2) -> oauth2
        .authenticationEntryPoint(myCustomEntryPoint)
        .jwt()
    )
    // ... no need for a custom filter

由于您有一种自定义的方法来处理JWT，因此可以发布自己的JwtDecoder实现：

@Bean
public JwtDecoder jwtDecoder() {
    return (encodedJwt) -> {
        // verify the JWT
    }
}

Spring Security的不记名令牌过滤器将在适当的时间调用您的AuthenticationEntryPoint，并减少您的应用程序的一些定制。

下面是我们如何捕获JwtException（io.jsonwebtoken.ExpiredJwtException）。
关键部件包括：

• 在配置UsernamePasswordAuthenticationFilter之前配置JWTFilter
• 解析JWT标记并捕获ExpiredJwtException
• 将ExpiredJwtException Package 在AuthenticationException的一个实现中并重新引发，以便在CustomAuthenticationEntryPoint中处理它。请注意，org.springframework.security.web.access.ExceptionTranslationFilter#handleSpringSecurityException仅对AuthenticationException和AccessDeniedException委托AuthenticationEntryPoint
  JWT筛选器

@Slf4j
public class JWTFilter extends GenericFilterBean {

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) {
        HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;

        String jwt = resolveToken(httpServletRequest);

        try {
            Claims claims = Jwts.parserBuilder().setSigningKey(key).build()
                    .parseClaimsJws(jwt).getBody();

            //everything is valid !!, let's login
            Authentication authentication = getAuthentication(claims);
            SecurityContextHolder.getContext().setAuthentication(authentication);
        } catch (ExpiredJwtException e) {
            log.error("Expired JWT token.", e);
            //HANDLE IT HERE::::: wrap ExpiredJwtException in AuthenticationException and rethrow Exception
           throw new CredentialsExpiredException("Expired jwt credentials ", e);

        } catch (OtherExceptions e) {
            log.info("JWT token compact of handler are invalid.");
            log.trace("JWT token compact of handler are invalid trace: ", e);
        }

        //finally filter it through
        filterChain.doFilter(servletRequest, servletResponse);
    }

}

//您可以简单地用try块包围Filter类并捕获此//异常

catch (Exception exception){
                log.error("Error logging in : {} ", exception.getMessage());
                response.setHeader("error",exception.getMessage());
                response.setStatus(FORBIDDEN.value());
                Map<String,String > error = new HashMap<>();
                error.put("error_message",exception.getMessage());
                response.setContentType(APPLICATION_JSON_VALUE);
                new ObjectMapper().writeValue(response.getOutputStream(),error);
            }

//然后在验证标记catch的util类中//

public Boolean validateToken(String token, UserDetails userDetails, HttpServletRequest request)  {
        try {
            final String username = extractUsername(token);
            log.info("Username " + username.equals(userDetails.getUsername()));
            return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
        } catch (ExpiredJwtException expiredJwtException) {
            log.info("Utils :: validateToke :: token Exception -> expired!");
            request.setAttribute("expired",expiredJwtException.getMessage());
            throw new ExpiredJwtException(expiredJwtException.getHeader(), expiredJwtException.getClaims(), "Expired JWT token");

//按照这些步骤操作后，您将在中获得所需的响应。