使用Spring Security的访问被拒绝的页面不起作用

Question

I am using the below configuration for access denied page

 <security:access-denied-handler error-page="/noAccess"/>

and then mapped /noAccess to the controller. but when I try to access resource to which i dont have access I get an error page

HTTP Status 404 - /mycontext/noAccess in the browser

though when I type the whole url http://abc.mycompany:8080/mycontext/noAccess I can see the error page. any idea why spring is not redirecting to the controller ?

Answer 1

I am using below configuration for access denied page in my project and it is working for me.

Make changes according to your need.

<security:http auto-config="true" use-expressions="true" access-denied-page="/accessDenied.jsp">

        <security:form-login login-page="/index.jsp"
            default-target-url="/jsp/home.jsp" />


        <security:intercept-url pattern="/jsp/listInBetweenPlaces.jsp"
            access="permitAll" />
</security:http>

Answer 2

Add the following to your bean configuration.

  <mvc:view-controller path="/uncaughtException"/>
  <mvc:view-controller path="/resourceNotFound"/>
  <mvc:view-controller path="/dataAccessFailure"/>

 <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver"    p:defaultErrorView="uncaughtException">
    <property name="exceptionMappings">
        <props>
            <prop key=".DataAccessException">dataAccessFailure</prop>
            <prop key=".NoSuchRequestHandlingMethodException">resourceNotFound</prop>
            <prop key=".TypeMismatchException">resourceNotFound</prop>
            <prop key=".MissingServletRequestParameterException">resourceNotFound</prop>
        </props>
    </property>
</bean>

Create the following pages and add these to Context folder

     resourceNotFound.jsp
     uncaughtException.jsp
     dataAccessFailure.jsp