When the web session expires, Spring Security responds with a 403 HTTP status. Ideally, it would respond with a 401. Unauthorized and Forbidden are different. The request to a secured resource should only return a 403 if there is a valid session, but the user just doesn't have permissions to said resource. If a resource is secured and there is no authenticated session, then Spring Security should return a 401.

My application needs to be very specific about distinguishing between these 2 error codes.

My question is, how can I customize this behavior? For reference to my argument on the differences between 401 and 403, [read this](http://en.wikipedia.org/wiki/HTTP_403#Difference_from_status_.22401_Unauthorized.22).