title: Handling AccessDenied with Method Level Security
body: <p>i have a method secured with spring security as follows:</p>
  
  <pre><code>@PreAuthorize("hasRole('add_user')")
  public void addUser(User user) ;
  </code></pre>
  
  <p>and if a user with no enoguh permissions is trying to invoke it 
  , an accessDenied exception is thrown:</p>
  
  <pre><code>org.springframework.security.access.AccessDeniedException: Access is denied
  </code></pre>
  
  <p>this is what's expected, but the question is, why the defined <strong>access-denied-handler</strong></p>
  
  <p>in security.xml configuration file is <strong>not working</strong>:</p>
  
  <pre><code>&lt;access-denied-handler error-page="accessDenied"/&gt;
  </code></pre>
  
  <p><strong>I mean by not working</strong> that when user with not enough permission when trying to press the button addUser which will invoke the service addUser (that's only accessible by user has this permission) an AccessDenied Exception is thrown and that's the desired behavior, but the user isn't redirected to the access denied exception as configured in xml. </p>
  
  <p>shouldn't the user gets redirected automatically to access denied page when this exception is thrown, or i have to define such behavior explicitly in code ?</p>
  
  <p>please advise.</p>
  
  <p>I am using <strong>Spring Security 3.0.5</strong> with <strong>JSF 2.1</strong> and <strong>ICEFaces 2</strong></p>
  
  <p><strong>UPDATE:</strong> applicationSecurity.xml:</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"  
      xmlns:beans="http://www.springframework.org/schema/beans" 
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:util="http://www.springframework.org/schema/util"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
            http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
            http://www.springframework.org/schema/security
            http://www.springframework.org/schema/security/spring-security-3.0.4.xsd
            http://www.springframework.org/schema/util
            http://www.springframework.org/schema/util/spring-util-3.1.xsd"&gt;
  
  
          &lt;!-- Enable @pre, @post spring security method level annotations --&gt;
          &lt;global-method-security pre-post-annotations="enabled" /&gt;   
  
  
          &lt;http use-expressions="true"  auto-config="true" access-denied-page="/accessDenied"&gt;
  
       &lt;session-management session-fixation-protection="none"/&gt;
  
          &lt;remember-me  token-validity-seconds="1209600"/&gt;
  
  
          &lt;intercept-url pattern="/accessDenied" access="permitAll"/&gt;        
          &lt;intercept-url pattern="/login" access="permitAll"/&gt;
          &lt;intercept-url pattern="/j_spring_security_check" access="permitAll" /&gt;
  
  
          &lt;intercept-url pattern="/faces/javax.faces.resource/**" access="permitAll" /&gt;
          &lt;intercept-url pattern="/xmlhttp/**" access="permitAll" /&gt;
          &lt;intercept-url pattern="/resources/**" access="permitAll" /&gt;        
          &lt;intercept-url pattern="/scripts/**" access="permitAll" /&gt;
          &lt;intercept-url pattern="/images/**" access="permitAll" /&gt;
          &lt;intercept-url pattern="/css/**" access="permitAll" /&gt;
  
  
          &lt;!-- All pages requires authentication (not anonymous user) --&gt;
  
          &lt;intercept-url pattern="/**" access="isAuthenticated()" /&gt;
          &lt;intercept-url pattern="/faces/**" access="isAuthenticated()" /&gt;
  
  
          &lt;form-login default-target-url="/"   
          always-use-default-target="true"            
              login-processing-url="/j_spring_security_check"         
              login-page="/login"
              authentication-failure-url="/login?login_error=1"                                                               
          /&gt;
  
          &lt;logout logout-url="/logout" logout-success-url="/login" /&gt;     
      &lt;/http&gt;
  
      &lt;authentication-manager alias="authenticationManager"&gt;          
        &lt;authentication-provider user-service-ref="userDetailsServiceImpl"/&gt;    
      &lt;/authentication-manager&gt;
  
  
      &lt;/beans:beans&gt;
  </code></pre>
  
  <p><strong>UPDATE 2</strong> : debugs before exception:</p>
  
  <pre><code>DEBUG [http-bio-8080-exec-1] (PrePostAnnotationSecurityMetadataSource.java:93) - @org.springframework.security.access.prepost.PreAuthorize(value=hasRole('add_user')) found on specific method: public void com.myapp.service.impl.UserServiceImpl.addUser(com.myapp.domain.User) throws java.lang.Exception,org.springframework.security.access.AccessDeniedException
  DEBUG [http-bio-8080-exec-1] (DelegatingMethodSecurityMetadataSource.java:66) - Adding security method [CacheKey[com.myapp.service.impl.UserServiceImpl; public abstract void com.myapp.service.UserService.addUser(com.myapp.domain.User) throws java.lang.Exception,org.springframework.security.access.AccessDeniedException]] with attributes [[authorize: 'hasRole('add_user')', filter: 'null', filterTarget: 'null']]
  DEBUG [http-bio-8080-exec-1] (AbstractSecurityInterceptor.java:191) - Secure object: ReflectiveMethodInvocation: public abstract void com.myapp.service.UserService.addUser(com.myapp.domain.User) throws java.lang.Exception,org.springframework.security.access.AccessDeniedException; target is of class [com.myapp.service.impl.UserServiceImpl]; Attributes: [[authorize: 'hasRole('add_user')', filter: 'null', filterTarget: 'null']]
  DEBUG [http-bio-8080-exec-1] (AbstractSecurityInterceptor.java:292) - Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@c650d918: Principal: org.springframework.security.core.userdetails.User@db344023: Username: user@mycomp.com; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: access_viewUsers; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffde5d4: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: E6BBAC0CD4499B1455227DC6035CC882; Granted Authorities: access_viewUsers
  DEBUG [http-bio-8080-exec-1] (AffirmativeBased.java:53) - Voter: org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter@1d1e082e, returned: -1
  DEBUG [http-bio-8080-exec-1] (AffirmativeBased.java:53) - Voter: org.springframework.security.access.vote.RoleVoter@1eab12f1, returned: 0
  DEBUG [http-bio-8080-exec-1] (AffirmativeBased.java:53) - Voter: org.springframework.security.access.vote.AuthenticatedVoter@71689bf1, returned: 0
  </code></pre>