AccessController { @RequestMapping(value="/login/forbidden", method=RequestMethod.GET) @PreAuthorize("permitAll") public String loginForbidden(HttpServletRequest request, Model model) { AccessDeniedException exception = (AccessDeniedException) request.getAttribute(WebAttributes.ACCESS_DENIED_403); String msg = getMessage(exception); if (StringUtils.isNotBlank(msg)) { model.addAttribute("errorMessage", msg); } return "/login"; }  @RequestMapping(value="/login", method=RequestMethod.GET) @PreAuthorize("permitAll") String login(); @RequestMapping(value="/login/error", method=RequestMethod.GET) @PreAuthorize("permitAll") String loginError(HttpSession session, Model model); @RequestMapping(value="/login/forbidden", method=RequestMethod.GET) @PreAuthorize("permitAll") String loginForbidden(HttpServletRequest request, Model model);  }
@Test public void loginForbidden() { when(accessDeniedException.getMessage()).thenReturn("message"); when(request.getAttribute(WebAttributes.ACCESS_DENIED_403)).thenReturn(accessDeniedException); String view = new AccessController().loginForbidden(request, model); assertEquals("/login", view); verify(model).addAttribute("errorMessage", "message"); }