<p>I want my controller to return the right HTTP response code when the user lacks permission to view a particular page.</p>

[{'answer_id': 45568, 'author': 'John Boker', 'author_id': 2847, 'author_profile': 'https://Stackoverflow.com/users/2847', 'pm_score': 3, 'selected': False, 'text': '<p>Use this:\n<code>response.setStatus(403)</code>.</p>\n'}, {'answer_id': 45585, 'author': 'Cheekysoft', 'author_id': 1820, 'author_profile': 'https://Stackoverflow.com/users/1820', 'pm_score': 5, 'selected': True, 'text': '<p><strong>Quickie</strong></p>\n\n<p>If you are using plain JSP views (as is most common), then simply add</p>\n\n<pre><code>&lt;% response.setStatus( 403 ); %&gt;\n</code></pre>\n\n<p>somewhere in your view file. At the top is a nice place.</p>\n\n<p><strong>Detail</strong></p>\n\n<p>In MVC, i would always set this in the view, and in most cases with Spring-MVC, use the <code>SimpleMappingExceptionResolver</code> to present the correct view in response to a thrown runtime Exception. </p>\n\n<p>For example: create and throw a <code>PermissionDeniedException</code> in your controller or service layer and have the exception resolver point to a view file <code>permissionDenied.jsp</code>. This view file sets the 403 status and shows the user an appropriate message.</p>\n\n<p>In your Spring bean XML file:</p>\n\n<pre><code>&lt;bean id="exceptionResolver"\n      class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver"&gt;\n  &lt;property name="exceptionMappings"&gt;\n    &lt;props&gt;\n      &lt;prop key="PermissionDeniedException"&gt;          \n        rescues/permissionDenied\n      &lt;/prop&gt;\n      ... set other exception/view mappings as &lt;prop&gt;s here ...\n    &lt;/props&gt;\n  &lt;/property&gt;\n  &lt;property name="defaultErrorView" value="rescues/general" /&gt;\n&lt;/bean&gt;\n\n&lt;bean id="viewResolver"\n      class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;\n  &lt;property name="viewClass" value="org.springframework.web.servlet.view.JstlView" /&gt;\n  &lt;property name="prefix" value="/WEB-INF/views/" /&gt;\n  &lt;property name="suffix" value=".jsp" /&gt;\n&lt;/bean&gt;\n</code></pre>\n\n<p>If you need to implement a user login mechanism, take a look at <a href="http://static.springframework.org/spring-security/site/index.html" rel="noreferrer">Spring Security</a> (formerly Acegi Security).</p>\n'}, {'answer_id': 45620, 'author': 'Joe Liversedge', 'author_id': 4552, 'author_profile': 'https://Stackoverflow.com/users/4552', 'pm_score': 4, 'selected': False, 'text': '<p>Using an <code>ExceptionResolver</code> is a great way to go, but if you just want this to be view-independent, you could certainly make a call to <code>response.sendError(HttpServletResponse.SC_FORBIDDEN, "AdditionalInformationIfAvailable");</code> in your Controller.</p>\n'}, {'answer_id': 28883524, 'author': 'yankee', 'author_id': 327301, 'author_profile': 'https://Stackoverflow.com/users/327301', 'pm_score': 6, 'selected': False, 'text': '<p>Create an Exception annotated with <a href="http://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/bind/annotation/ResponseStatus.html">@ResponseStatus</a> e.g. like this:</p>\n\n<pre class="lang-java prettyprint-override"><code>@ResponseStatus(HttpStatus.FORBIDDEN)\npublic class ForbiddenException extends RuntimeException {\n}\n</code></pre>\n\n<p>Now just throw that Exception in your handler method and the response will have status 403.</p>\n'}, {'answer_id': 38467064, 'author': 'Chris Ritchie', 'author_id': 2591088, 'author_profile': 'https://Stackoverflow.com/users/2591088', 'pm_score': 6, 'selected': False, 'text': '<p>You can also just throw</p>\n\n<pre><code>org.springframework.security.access.AccessDeniedException("403 returned");\n</code></pre>\n\n<p>This returns a 403 in the response header.</p>\n'}, {'answer_id': 72009693, 'author': 'Largos', 'author_id': 13061563, 'author_profile': 'https://Stackoverflow.com/users/13061563', 'pm_score': 3, 'selected': False, 'text': '<p>Use <code>ResponseStatusException</code> :</p>\n<pre class="lang-java prettyprint-override"><code>@GetMapping(&quot;/demo&quot;)\npublic String demo(){\n  if (forbidden){\n    throw new ResponseStatusException(HttpStatus.FORBIDDEN); \n  }\n}\n</code></pre>\n'}]
['https://Stackoverflow.com/questions/45546', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/4702/']