<div dir="ltr" style="text-align: justify;">
<p>In this tutorial we will discuss about the using custom access denied page or 403 page(Customized Access Denied Page in Spring Security) for access control for a specific resource or url.</p>
<p>Access denied page appears when an unauthorized user which has not privileged for viewing a page/section , try to view it using their login &; password. For example, when an unprivileged user tries to view an admin section pages , an error page will appear showing the error code 403 and a message &#8220;Access is denied&#8221;. In this section, we will customize the access denied page.</p>
<div id="ads-id" align="center"></div>
<p>In the below example, we will ensure secure URL access by providing auto generated Login form using Spring Security. User needs to provide correct login credential to view the page. For accessing admin section, you need to provide admin login and password. While for user section, both admin and user login are permitted. If you access with non admin privileges then it redirect to the custom access denied page as follows.<br />
There are two ways for using custom denied page.</p>
<h2><b>1. </b><b>access-denied-handler</b></h2>
<pre class="highlight"><;security:http auto-config="true">; 
 <;security:intercept-url pattern="/admin*" access="ROLE_ADMIN" />; 
 <;security:logout logout-success-url="/index" />; 
 <;security:intercept-url pattern="/index*" access="ROLE_USER,ROLE_ADMIN" />; 
 <;security:logout logout-success-url="/index" />; 
 <;security:access-denied-handler error-page="/403"/>; 
<;/security:http>; 
</pre>
<p> ;</p>
<div style="background-color: #f2f9fc; border: 1px solid #c9e6f2; border-radius: 3px; padding: 16px; line-height: 1.45;"><span style="color: red; font-size: x-large; text-align: center;"><b>Popular Tutorials</b></span></p>
<ul style="text-align: left;">
<li><b><a href="https://dineshonjava.com/spring-tutorial/"><em><strong>Spring Tutorial</strong> </em></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-web-mvc-framework-chapter-38/"><strong><em>Spring MVC Web Tutorial </em></strong></a></b></li>
<li><b><a href="https://dineshonjava.com/introduction-to-spring-boot-a-spring-boot-complete-guide/"><strong>Spring Boot Tutorial</strong> </a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-take-baby-step-to-secure/"><em>Spring Security Tutorial</em></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-aop-tutorial-with-example-aspect-advice-pointcut-joinpoint/"><em>Spring AOP Tutorial</em></a></b></li>
<li><b><a href="https://dineshonjava.com/using-spring-jdbc-framework-chapter-32/"><em>Spring JDBC Tutorial</em></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-hateoas-hypermedia-driven-restful-web-service/"><em><strong>Spring HATEOAS </strong></em></a></b></li>
<li><b><a href="https://dineshonjava.com/microservices-with-spring-boot/"><em><strong>Microservices with Spring Boot</strong></em></a></b></li>
<li><b><a href="https://dineshonjava.com/jax-rs-web-service-tutorial/"><strong><em>REST Webservice</em> </strong></a></b></li>
<li><b><a href="https://dineshonjava.com/core-java-baby-step-to-be-best-java-ian/"><em><strong>Core Java </strong></em></a></b></li>
<li><b><a href="https://dineshonjava.com/hibernate-3-on-baby-steps/"><em><strong>Hibernate Tutorial</strong></em></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-batch-process-with-example/"><strong><em>Spring Batch</em> </strong></a></b></li>
</ul>
</div>
<p><b>Tag- <i>access-denied-handler</i></b><br />
Defines the access-denied strategy that should be used. An access denied page can be defined or a reference to an <b><i>AccessDeniedHandler </i></b>instance.</p>
<p><b>Attribute- <i>error-page</i></b><br />
The access denied page that an authenticated user will be redirected to if they request a page which they don&#8217;t have the authority to access.</p>
<p>It means the user with authority as <b>ROLE_ADMIN</b> can have access to URL <i><b>/admin</b></i> . Also, the URL <i><b>/index </b></i>is open for both type of users having authority<b> ROLE_USER or ROLE_ADMIN</b> . If non authorized user try to access /admin, a &#8220;<b>http 403 access denied custom page(403.jsp)</b>&#8221; will be displayed.</p>
<h2><b>2. AccessDeniedHandler:</b></h2>
<p>In second way, create a class and implements Spring’s AccessDeniedHandler, override handle() method and put your access denied logic inside.</p>
<pre class="highlight">package com.dineshonjava.error.handler; 
 
import java.io.IOException; 
import javax.servlet.ServletException; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 
import org.springframework.security.access.AccessDeniedException; 
import org.springframework.security.web.access.AccessDeniedHandler; 
 
public class MyAccessDeniedHandler implements AccessDeniedHandler { 
 private String accessDeniedUrl; 
 
 public MyAccessDeniedHandler() { 
 } 
 
 public MyAccessDeniedHandler(String accessDeniedUrl) { 
 this.accessDeniedUrl = accessDeniedUrl; 
 } 
 
 @Override 
 public void handle(HttpServletRequest request, 
 HttpServletResponse response, 
 AccessDeniedException accessDeniedException) throws IOException, 
 ServletException { 
 
 response.sendRedirect(accessDeniedUrl); 
 request.getSession().setAttribute("message", 
 " Sorry user_dineshonjava You don't have privileges to view this page!!!"); 
 
 } 
 
 public String getAccessDeniedUrl() { 
 return accessDeniedUrl; 
 } 
 
 public void setAccessDeniedUrl(String accessDeniedUrl) { 
 this.accessDeniedUrl = accessDeniedUrl; 
 } 
} 
</pre>
<p><b>Declares above Spring bean</b>.</p>
<pre class="highlight"><;bean id="accessDeniedHandler" class="com.dineshonjava.error.handler.MyAccessDeniedHandler">; 
 <;property name="accessDeniedUrl" value="403" />; 
 <;/bean>; 
 
<;security:http auto-config="true">; 
 <;security:intercept-url pattern="/admin*" access="ROLE_ADMIN" />; 
 <;security:logout logout-success-url="/index" />; 
 <;security:intercept-url pattern="/index*" access="ROLE_USER,ROLE_ADMIN" />; 
 <;security:logout logout-success-url="/index" />; 
 <;security:access-denied-handler ref="accessDeniedHandler"/>; 
<;/security:http>; 
</pre>
<p><b>Some helpful example related to this section is given below :</b><br />
Example related to Spring Security Authorized Access Using Auto generated Login Form, <b><a href="https://dineshonjava.com/spring-security-hello-world-example/" target="_blank" rel="noopener">Click Here</a></b> .<br />
Example related to Spring Security Authorized Access Using Custom Login Form, <b><a href="https://dineshonjava.com/spring-security-form-based-login-example/" target="_blank" rel="noopener">Click Here</a></b> .<br />
Example related to Spring Security Authorized Access with Customized Login from Database <b><a href="https://dineshonjava.com/spring-security-login-form-using/" target="_blank" rel="noopener">Click Here</a></b> .</p>
<p>In last <b><a href="https://dineshonjava.com/spring-security-authorized-access/" target="_blank" rel="noopener">Spring Security Authorized Access Control Example</a></b> , if non authorized user try to access a protected page, default &#8220;<b>http 403 access denied</b>&#8221; will be display :</p>
<div class="separator" style="clear: both; text-align: center;"><img src="https://dineshonjava.com/wp-content/uploads/2013/02/authorized3.png" border="0" /></div>
<h2><b>Project Directory structure-</b></h2>
<div class="separator" style="clear: both; text-align: center;"><img src="https://dineshonjava.com/wp-content/uploads/2013/02/authorized403.png" border="0" /></div>
<p><b>Creating welcome page (welcome.jsp)</b></p>
<pre class="highlight"><;%@ page language="java" contentType="text/html; charset=ISO-8859-1" 
 pageEncoding="ISO-8859-1"%>; 
<;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">; 
<;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>; 
<;html>; 
<;head>; 
<;meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">; 
<;title>;WELCOME TO SECURE AREA<;/title>; 
<;/head>; 
<;body>; 
 <;h1>;Message : ${message}<;/h1>; 
 <;h1>;Author : ${author}<;/h1>; 
 <;a href='<;c:url value="/j_spring_security_logout" />;' >; Logout<;/a>; 
<;/body>; 
<;/html>; 
</pre>
<p><b>Assume below is your customized 403 page:<br />
403.jsp<br />
</b></p>
<pre class="highlight"><;%@ page language="java" contentType="text/html; charset=ISO-8859-1" 
 pageEncoding="ISO-8859-1"%>; 
<;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">; 
<;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>; 
<;html>; 
<;head>; 
<;meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">; 
<;title>;HTTP Status 403 - Access is denied<;/title>; 
<;/head>; 
<;body>; 
 <;h1>;Message : ${message}<;/h1>; 
<;/body>; 
<;/html>; 
</pre>
<p><b>Creating AdminController class (AdminController.java)<br />
AdminController.java<br />
</b></p>
<pre class="highlight">package com.dineshonjava.admin.controller; 
 
import java.security.Principal; 
 
import org.springframework.stereotype.Controller; 
import org.springframework.ui.ModelMap; 
import org.springframework.web.bind.annotation.RequestMapping; 
import org.springframework.web.bind.annotation.RequestMethod; 
 
/** 
 * @author Dinesh Rajput 
 * 
 */ 
@Controller 
public class AdminController { 
 
 @RequestMapping(value = "/admin", method = RequestMethod.GET) 
 public String welcomeAdmin(ModelMap model, Principal principal) { 
 String username = principal.getName(); 
 model.addAttribute("author", username); 
 model.addAttribute("message", "Hello Spring Security - ADMIN PAGE"); 
 return "welcome"; 
 
 } 
 
 @RequestMapping(value = "/index", method = RequestMethod.GET) 
 public String printMessage(ModelMap model, Principal principal) { 
 
 String username = principal.getName(); 
 model.addAttribute("author", username); 
 model.addAttribute("message", "Hello Spring Security - USER LOGIN"); 
 return "welcome"; 
 } 
 
 @RequestMapping(value = "/403", method = RequestMethod.GET) 
 public String accessDenied(ModelMap model, Principal principal) { 
 String username = principal.getName(); 
 model.addAttribute("message", "Sorry "+username+" You don't have privileges to view this page!!!"); 
 return "403"; 
 } 
 
} 
</pre>
<p><b>Spring Securing Configuration file (sdnext-security.xml)</b></p>
<pre class="highlight"><;?xml version="1.0" encoding="UTF-8"?>; 
<;beans xmlns="http://www.springframework.org/schema/beans" 
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
 xmlns:> 
<b>Spring Configuration File (sdnext-servlet.xml)</b> 
<pre class="highlight"><;?xml version="1.0" encoding="UTF-8"?>; 
<;beans xmlns="http://www.springframework.org/schema/beans" 
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
 xmlns:context="http://www.springframework.org/schema/context" 
 xmlns:tx="http://www.springframework.org/schema/tx" 
 xsi:schemaLocation=" 
http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
http://www.springframework.org/schema/context 
http://www.springframework.org/schema/context/spring-context-3.0.xsd 
http://www.springframework.org/schema/tx 
http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">; 
 
 <;context:component-scan base-package="com.dineshonjava.admin" />; 
 
 
 <;bean id="jspViewResolver" 
 class="org.springframework.web.servlet.view.InternalResourceViewResolver">; 
 <;property name="viewClass" 
 value="org.springframework.web.servlet.view.JstlView" />; 
 <;property name="prefix" value="/WEB-INF/views/" />; 
 <;property name="suffix" value=".jsp" />; 
 <;/bean>; 
 
<;/beans>; 
</pre>
<p><b>Running the example</b></p>
<p>Now, if non authorized user is access the protected page, your customize 403 page will be displayed :</p>
<p>When you try to access the admin using below URL :</p>
<p><i><b>http://localhost:8080/sdnext/spring_security_login;jsessionid=A576B0C8EFB29231141D4FD3DE15A751</b></i></p>
<p>You will get the below page :</p>
<div class="separator" style="clear: both; text-align: left;"><img src="https://dineshonjava.com/wp-content/uploads/2013/02/authorized403-1.png" width="600" height="174" border="0" /></div>
<p>When you try to access the admin page/section using a normal user login(<b>Username :<i> user_dineshonjava</i>, Password: <i>sweetu</i></b>), you will get the below customized access denied page :</p>
<div class="separator" style="clear: both; text-align: center;"><img src="https://dineshonjava.com/wp-content/uploads/2013/02/authorized403-2-1024x135.png" width="600" height="84" border="0" /></div>
<h3><b>Download Source Code + Libs</b><br />
<a href="https://sites.google.com/site/dinesh9582486434/my-forms/SpringSecurityCustomAccessDeniedPage.zip?attredirects=0&;d=1" target="_blank" rel="noopener"><b>SpringSecurityCustomAccessDeniedPage.zip</b></a></h3>
<p><b>References- </b><br />
<a href="https://dineshonjava.com/spring-security-form-based-login-example/" target="_blank" rel="noopener"><b>https://dineshonjava.com/spring-security-form-based-login-example/</b></a><br />
<a href="http://static.springsource.org/spring-security/site/" target="_blank" rel="noopener"><b>Spring Security</b></a><br />
<a href="http://static.springsource.org/spring-security/site/docs/3.0.x/reference/springsecurity.html" target="_blank" rel="noopener"><b>Spring Security documentation</b></a></p>
<div style="background-color: #f2f9fc; border-radius: 3px; border: 1px solid #c9e6f2; line-height: 1.45; padding: 16px;"><span style="color: red; font-size: x-large; text-align: center;"><b>Spring Security Related Posts</b></span></p>
<ul>
<li><b><a href="https://dineshonjava.com/spring-security-interview-questions-and-answers/"><span style="color: red;">Spring Security Interview Questions and Answers</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-java-based-configuration-with-example/"><span style="color: red;">Spring Security Java Based Configuration with Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-xml-namespace-configuration-example/"><span style="color: red;">Spring Security XML Namespace Configuration Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-hello-world-example/"><span style="color: red;">Spring Security XML Based Hello World Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-form-based-login-example/"><span style="color: red;">Spring Security form-based login example </span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-login-form-using/"><span style="color: red;">Spring Security Login Form Based Example Using Database</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-http-basic/"><span style="color: red;">Spring Security Authentication Example Using HTTP Basic </span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-authorized-access/"><span style="color: red;"> Spring Security Authorized Access Control Example </span></a></b></li>
<li><b><a href="https://dineshonjava.com/customize-http-403-access-denied-page/"><span style="color: red;">Spring Security Customized Access Denied Page</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-custom-error-message/"><span style="color: red;">Spring Security Custom Error Message</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-logout-example/"><span style="color: red;"> Spring Security Logout Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-fetch-logged-in-username/"><span style="color: red;">Spring Security Fetch Logged in Username</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-password-hashing/"><span style="color: red;">Spring Security Password Hashing</span></a></b></li>
</ul>
<p> ;</p>
</div>
<p> ;</p>
<div style="background-color: #ff99cc;"> <b> <;<;<a href="https://dineshonjava.com/spring-security-authorized-access/">previous</a><;<; || <a href="https://dineshonjava.com/spring-security-take-baby-step-to-secure/">index </a>|| >;>;<a href="https://dineshonjava.com/spring-security-custom-error-message/">next</a>>;>;</b></div>
<p> ;</p>
</div>
<div class="wp-post-navigation"> 
									 <div class="wp-post-navigation-pre"> 
									 <a href="https://dineshonjava.com/spring-security-authorized-access/">Previous</a> 
									 </div> 
									 <div class="wp-post-navigation-next"> 
									 <a href="https://dineshonjava.com/spring-security-password-hashing/">Next</a> 
									 </div> 
									</div>
<script type="text/javascript">
jQuery(document).ready(function($) {
 $.post('https://dineshonjava.com/wp-admin/admin-ajax.php', {action: 'mts_view_count', id: '574'});
});
</script>
Strategy Design Patterns We can easily create a strategy design pattern using lambda. To implement…
Decorator Pattern A decorator pattern allows a user to add new functionality to an existing…
Delegating pattern In software engineering, the delegation pattern is an object-oriented design pattern that allows…
Technology has emerged a lot in the last decade, and now we have artificial intelligence;…
Managing a database is becoming increasingly complex now due to the vast amount of data…
Overview In this article, we will explore Spring Scheduler how we could use it by…