How to handle HTTP 403 with Spring Security 3.0.x -

i'm facing little issue spring security 3.0.x (3.0.2 in particular @ moment). whole application i'm working on working except when doesn't have authorities tries log on.

when occurs, users redirected "welcome" page, since username/password valid, , receive cute white page : "error 403: access denied"

so, i've been looking on net trying find how behavior can handled. far i've come conclusion, please correct me if i'm wrong, managed exceptiontranslationfilter. don't quite understand how make use of information.

i've tryied edit securitycontext.xml add access-denied-handler tag http tag, doesn't work. need add more tag make work? there other possibilities make application more user-friendly?

edit : redirect page, let's says 403.html, example.

sincerly,
thanks

i still don't why had implement own access handler... have faced same task:

 <security:access-denied-handler error-page="/accessdenied"/> - works charm. 

don't forget specify handler in controller:

 @requestmapping(value = "/accessdenied")       public string accessdenied() {              return "accessdenied"; // logical view name        } 

update spring boot(2014 oct):

@configuration @enablewebsecurity public class securityconfiguration extends websecurityconfigureradapter {      @override     protected void configure(httpsecurity http) throws exception {         http.exceptionhandling().accessdeniedhandler(customhandler) or .accessdeniedpage("/somepage.html").and             .formlogin()                 .failurehandler(ajaxauthenticationfailurehandler)}  

nowadays don't return views such task since angular js kicks in can use failure/success handler , return tailored json responses. sufficient use failure handler choose want control kick in. don't use view resolvers there ui tiles frameworks(such angular partials) able construct pieces single page you. html pieces stored on server , served static resources.

lets play embedded tomcat achieve similar behavior web.xml !

@configuration @enableautoconfiguration public class applicationwebxml extends springbootservletinitializer {  private static final logger logger = loggerfactory.getlogger(application.class);  @override protected springapplicationbuilder configure(springapplicationbuilder application) {     return application.profiles(adddefaultprofile())             .showbanner(false)             .sources(application.class); }  //required container customizer work, numerous tutorials didn't work me, tried overriding default 1 @bean public embeddedservletcontainerfactory servletcontainer() {     tomcatembeddedservletcontainerfactory tomcat = new tomcatembeddedservletcontainerfactory();     return tomcat; }  @bean public embeddedservletcontainercustomizer containercustomizer(  ) {     return new embeddedservletcontainercustomizer() {         @override         public void customize(configurableembeddedservletcontainer container) {             tomcatembeddedservletcontainerfactory containerfactory = (tomcatembeddedservletcontainerfactory) container;              containerfactory.setsessiontimeout(1); // interest, remove necessary              containerfactory.adderrorpages(new errorpage(httpstatus.forbidden,"/views/accessdenied.html"),                     new errorpage(httpstatus.not_found,"/views/notfound.html"));             containerfactory.addconnectorcustomizers(new tomcatconnectorcustomizer() {                 @override                 public void customize(connector connector) {                     connector.setport(8082);// interest, remove necessary                 }             });         }     }; } 

}