security - How to catch AccessDeniedException in Spring Boot REST API -

i have simple spring boot rest api 2 endpoints, 1 protected 1 not. 1 protected, want catch accessdeniedexception , send 401 rather default 500 error. here security configuration:

@configuration @enablewebsecurity public class securityconfig extends websecurityconfigureradapter{  @override public void configure(websecurity websecurity) {     websecurity.ignoring().antmatchers("/"); }  @override protected void configure(httpsecurity http) throws exception {     http             .exceptionhandling()             .accessdeniedhandler(new accessdeniedhandler() {                 @override                 public void handle(httpservletrequest request, httpservletresponse response, org.springframework.security.access.accessdeniedexception accessdeniedexception) throws ioexception, servletexception {                     system.out.println("i here now!!!");                 }             });      http             .addfilterafter(getsecurityfilter(), filtersecurityinterceptor.class);     http             .sessionmanagement()             .sessioncreationpolicy(sessioncreationpolicy.stateless);     http             .csrf()             .disable();     http             .authorizerequests()             .antmatchers("/protected").anonymous(); }  public filter getsecurityfilter() {     return new filter() {         @override         public void init(filterconfig filterconfig) throws servletexception {             //do nothing here         }          @override         public void dofilter(servletrequest request, servletresponse response, filterchain chain) throws ioexception, servletexception {             string appkeyheadervalue = ((httpservletrequest)request).getheader("x-appkey");             if(appkeyheadervalue!=null && appkeyheadervalue.equals("my_key")) {                 chain.dofilter(request,response);             } else {                 throw new accessdeniedexception("access denied man");             }         }          @override         public void destroy() {          }     }; } 

}

i never see i here now!!! print statement, instead see default page whitelabel error page application has no explicit mapping /error, seeing fallback. tue jul 25 23:21:15 cdt 2017 there unexpected error (type=internal server error, status=500). access denied man notice how access denied man printed when exception being thrown.

when run project, see following in console: 2017-07-25 23:21:14.818 info 3872 --- [ restartedmain] s.w.s.m.m.a.requestmappinghandlermapping : mapped "{[/error]}" onto public org.springframework.http.responseentity<java.util.map<java.lang.string, java.lang.object>> org.springframework.boot.autoconfigure.web.basicerrorcontroller.error(javax.servlet.http.httpservletrequest) 2017-07-25 23:21:14.818 info 3872 --- [ restartedmain] s.w.s.m.m.a.requestmappinghandlermapping : mapped "{[/error],produces=[text/html]}" onto public org.springframework.web.servlet.modelandview org.springframework.boot.autoconfigure.web.basicerrorcontroller.errorhtml(javax.servlet.http.httpservletrequest,javax.servlet.http.httpservletresponse)

here how project structure looks like:

as suggested @afridi exception occurs before reaches controllers, has handled in filter chain. suggest following :

public class accessdeniedexceptionfilter extends onceperrequestfilter {      @override     public void dofilterinternal(httpservletrequest req, httpservletresponse res,                                  filterchain fc) throws servletexception, ioexception {         try {             fc.dofilter(request, response);         } catch (accessdeniedexception e) {          // log error if needed here redirect      requestdispatcher requestdispatcher =               getservletcontext().getrequestdispatcher(redirecturl);      requestdispatcher.forward(request, response);      } } 

add filter filter chain in

protected void configure(httpsecurity http) throws exception { http .... .addfilterafter(httpclientfilter(), accessdeniedexceptionfilter.class)