Last Modified 2021.11.29

Spring Security - Handling access denial

Add the following to redirect access denied user requests to the /WEB-INF/views/403.jsp page.

  <access-denied-handler error-page="/403" />
  <intercept-url pattern="/users/bye_confirm" access="permitAll"/>
  <intercept-url pattern="/users/welcome" access="permitAll"/>
  <intercept-url pattern="/users/signUp" access="permitAll"/>
  <intercept-url pattern="/users/login" access="permitAll"/>
  <intercept-url pattern="/images/**" access="permitAll"/>
  <intercept-url pattern="/css/**" access="permitAll"/>
  <intercept-url pattern="/js/**" access="permitAll"/>
  <intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')"/>
  <intercept-url pattern="/users/**" access="hasAnyRole('ROLE_ADMIN','ROLE_USER')"/>
  <intercept-url pattern="/bbs/**" access="hasAnyRole('ROLE_ADMIN','ROLE_USER')"/>
  <!-- omit -->

You need to declare a handler for "/403" in the controller with the above configuration. Otherwise, you will get a 404 error.

Create a 403.jsp file and add the following method to your HomeController.

<%@ page language="java" contentType="text/html; charset=UTF-8"
<%@ taglib uri="" prefix="spring"%>
<%@ page import="net.java_school.user.User" %>
<!DOCTYPE html>
<html lang="en">
<meta charset="UTF-8" />
<link rel="stylesheet" href="/css/screen.css" type="text/css" />
<script type="text/javascript" src="/js/jquery-3.2.1.min.js"></script>
<div id="wrap">

  <div id="header">
    <%@ include file="inc/header.jsp" %>
  <div id="main-menu">
    <%@ include file="inc/main-menu.jsp" %>
  <div id="container">
    <div id="content" style="min-height: 800px;">
      <div id="content-categories">Error</div>
      Access is Denied.
  <div id="sidebar">
  <div id="extra">
    <%@ include file="inc/extra.jsp" %>    
  <div id="footer">
    <%@ include file="inc/footer.jsp" %>

@RequestMapping(value="/403", method={RequestMethod.GET,RequestMethod.POST})
public String error403() {
  return "403";

Exclude 403 error from error page configuration in web.xml.


Run mvn clean compile war:inplace, rerun Tomcat, and visit http://localhost:8080/admin. If the user has only the ROLE_USER privilege, /WEB-INF/views/403.jsp will be displayed.

Implementing AccessDeniedHandler

If you have business logic to perform before showing the user an error page, you should configure your access denied handler by implementing the

Create a MyAccessDeniedHandler that implements AccessDeniedHandler.
package net.java_school.spring;


import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


public class MyAccessDeniedHandler implements AccessDeniedHandler {

  private String errorPage;

  public void setErrorPage(String errorPage) {
    this.errorPage = errorPage;

  public void handle(HttpServletRequest req, HttpServletResponse resp, AccessDeniedException e)
      throws IOException, ServletException {
    //TODO: business logic
    req.getRequestDispatcher(errorPage).forward(req, resp);

Add the following to security.xml.

<beans:bean id="my403" class="net.java_school.spring.MyAccessDeniedHandler">
    <beans:property name="errorPage" value="403" />

Modify the security.xml file as follows:

<access-denied-handler ref="my403" />

The Spring Security tag does not work for error pages set in web.xml because the request is forwarded to these error pages before the view-level security filter works.

Method Security

The simplest way to map an exception to an error page in Spring MVC is to use the SimpleMappingExceptionResolver. The following configuration maps to error-403 when the occurs, and to error when any other exception occurs. The view resolver interprets error-403 and error as /WEB-INF/views/error-403.jsp and /WEB-INF/views/error.jsp respectively.

<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
  <property name="defaultErrorView" value="error" />
  <property name="exceptionMappings">
      <prop key="AccessDeniedException">

After signing up and logging in with, try to withdraw membership with from the Bye menu.
@PreAuthorize("hasAnyRole('ROLE_ADMIN','ROLE_USER') and == principal.username")
public void bye(User user);

The highlighted part above will work and occur an, and you will see /WEB-INF/views/error-403.jsp.

On the Bye page, try to withdraw membership with and the wrong password.
public void bye(User user) {
  String encodedPassword = this.getUser(user.getEmail()).getPasswd();
  boolean check = this.bcryptPasswordEncoder.matches(user.getPasswd(), encodedPassword);
  if (check == false) {
    throw new AccessDeniedException("Wrong password!");

The highlighted part above will occur an, and you will see /WEB-INF/views/error-403.jsp.