title: Throw an exception in a WebFilter class and handle it in a ControllerAdvice class
body: <p>I'm trying to implement a <code>WebFilter</code> that checks a JWT and throw an exception if the check fails or the result is not valid. And I've a <code>@ControllerAdvice</code> class that handles those exceptions. But it doesn't work.</p>
  
  <h3>This is the <code>WebFilter</code> class:</h3>
  
  <pre><code>@Component
  public class OktaAccessTokenFilter implements WebFilter {
  
  private JwtVerifier jwtVerifier;
  
     @Autowired
     public OktaAccessTokenFilter(JwtVerifier jwtVerifier) {
          this.jwtVerifier = jwtVerifier;
     }
  
     @Override
     public Mono&lt;Void&gt; filter(ServerWebExchange exchange, WebFilterChain chain) {
          return Optional.ofNullable(exchange.getRequest().getHeaders().get("Authorization"))
              .flatMap(list -&gt; list.stream().findFirst())
              .filter(authHeader -&gt; !authHeader.isEmpty() &amp;&amp; authHeader.startsWith("Bearer "))
              .map(authHeader -&gt; authHeader.replaceFirst("^Bearer", ""))
              .map(jwtString -&gt; {
                  try {
                      jwtVerifier.decodeAccessToken(jwtString);
                  } catch (JoseException e) {
                      throw new DecodeAccessTokenException();
                  }
                  return chain.filter(exchange);
              }).orElseThrow(() -&gt; new AuthorizationException());
        }
  }
  </code></pre>
  
  <h3>And the exception handler:</h3>
  
  <pre><code>@ControllerAdvice
  public class SecurityExceptionHandler {
  
    @ExceptionHandler(AuthorizationException.class)
    public ResponseEntity authorizationExceptionHandler(AuthorizationException ex) {
  
      return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
  
    }
  
    @ExceptionHandler(DecodeAccessTokenException.class)
    public ResponseEntity decodeAccessTokenExceptionHandler(DecodeAccessTokenException ex) {
  
      return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
  
    }
  
  }
  </code></pre>
  
  <p>I think, the <code>@ControllerAdvice</code> class can not handle exceptions that <code>WebFilter</code> throws. Because, if I move the exceptions to the controller, it works. </p>
  
  <h3>I've change the code for this (for now):</h3>
  
  <pre><code>@Override
  public Mono&lt;Void&gt; filter(ServerWebExchange exchange, WebFilterChain chain) {
  
      Optional&lt;String&gt; authJwt = Optional.ofNullable(exchange.getRequest().getHeaders().get("Authorization"))
              .flatMap(list -&gt; list.stream().findFirst())
              .filter(authHeader -&gt; !authHeader.isEmpty() &amp;&amp; authHeader.startsWith("Bearer "))
              .map(authHeader -&gt; authHeader.replaceFirst("^Bearer", ""));
  
      if (authJwt.isPresent()) {
          String jwtString = authJwt.get();
          try {
              jwtVerifier.decodeAccessToken(jwtString);
          } catch (JoseException e) {
              exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
              return exchange.getResponse().writeWith(Mono.empty());
          }
      } else {
          exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
          return exchange.getResponse().writeWith(Mono.empty());
      }
  
      return chain.filter(exchange);
  }
  </code></pre>
  
  <p>What do you think about the problem? Do you know another way to implement it?</p>