Search code examples
authenticationspring-securityhttp-status-code-403

Spring security: show error 403 page instead of login form page for non-authenticated users

I've set basic spring authentication. When user comes to page and enters secured URL, login form is rendered, but I want to show error 403 page (or any other page i choose).

If I understand correctly I can't use access-denied-handler because user is not authenticated at all.

How do I show any other page than login form page to non-authenticated user, when he accesses secured URL?

Solution

  • When you are using form-login the default AuthenticationEntryPoint redirects to the login page.

    You can override this by injecting a custom entry point using the entry-point-ref attribute.

    You can use the code for Http403ForbiddenEntryPoint as a guideline (or use that directly if all you want is a response code sent to the client).