title: Spring security - creating 403 Access denied custom response
body: <p>I have a spring boot rest api with jwt authentication. The problem is i cannot get rid of default 403 Access Denied rest response which looks like this: </p>
  
  <pre><code>{
      "timestamp": 1516206966541,
      "status": 403,
      "error": "Forbidden",
      "message": "Access Denied",
      "path": "/api/items/2"
  }
  </code></pre>
  
  <p>I created custom AccessDeniedHandler:</p>
  
  <pre><code>public class CustomAccessDeniedHandler implements AccessDeniedHandler {
  
      @Override
      public void handle(HttpServletRequest req,
                         HttpServletResponse res,
                         AccessDeniedException accessDeniedException) throws IOException, ServletException {
  
  
  
          ObjectMapper mapper = new ObjectMapper();
          res.setContentType("application/json;charset=UTF-8");
          res.setStatus(403);
          res.getWriter().write(mapper.writeValueAsString(new JsonResponse()
                  .add("timestamp", System.currentTimeMillis())
                  .add("status", 403)
                  .add("message", "Access denied")));
      }
  }
  </code></pre>
  
  <p>and added it to WebConfig class</p>
  
  <pre><code>@EnableWebSecurity
  public class WebSecurity extends WebSecurityConfigurerAdapter {
  
      private UserDetailsService userDetailsService;
      private BCryptPasswordEncoder bCryptPasswordEncoder;
  
      @Autowired
      public WebSecurity(UserDetailsService userDetailsService, BCryptPasswordEncoder bCryptPasswordEncoder) {
          this.userDetailsService = userDetailsService;
          this.bCryptPasswordEncoder = bCryptPasswordEncoder;
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.NEVER)
                  .and()
                      .csrf().disable()
                      .authorizeRequests()
                      .antMatchers(HttpMethod.POST, REGISTER_URL).permitAll()
                      .anyRequest().authenticated()
                  .and()
                      .exceptionHandling().accessDeniedHandler(accessDeniedHandler())
                  .and()
                      .addFilter(new JWTAuthenticationFilter(authenticationManager(), tokenProvider()))
                      .addFilter(new JWTAuthorizationFilter(authenticationManager(), tokenProvider()));
  
      }
  
      @Override
      public void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder);
      }
  
      @Bean
      public TokenProvider tokenProvider(){
          return new TokenProvider();
      }
  
      @Bean
      public AccessDeniedHandler accessDeniedHandler(){
          return new CustomAccessDeniedHandler();
      }
  }
  </code></pre>
  
  <p>Despite this i'm still getting the default Access Denied response. When debugging i realized that the <code>handle</code> method from custom handler isn't even called. What is the case here?</p>