exception handling - Propagating AccessDeniedException in Spring Security -

in web application using spring security , spring mvc. have secured couple of methods @secured annotation , configured spring security in such way when 1 of methods accessed without proper role, user taken login page. however, not want behaviour when offending request comes ajax, implemented custom @exceptionhandler annotated method determine request's context.

this exception handler:

@exceptionhandler(accessdeniedexception.class) public void handleaccessdeniedexception(accessdeniedexception ex, httpservletrequest request, httpservletresponse response) throws exception {      if (isajax(request)) {         response.setstatus(httpservletresponse.sc_unauthorized);     } else {         throw ex;     } } 

this way can both handle exception myself (for example, log attempt of accessing @secured method) , let spring part , redirect user login page rethrowing accessdeniedexception. also, when request comes ajax set response status sc_unauthorized , handle error on client side. now, seems working fine, getting following error each time rethrow exception handleaccessdeniedexception method:

error org.springframework.web.servlet.mvc.method.annotation.exceptionhandlerexceptionresolver - failed invoke @exceptionhandler method: public void app.controller.basecontroller.handleaccessdeniedexception(org.springframework.security.access.accessdeniedexception,javax.servlet.http.httpservletrequest,javax.servlet.http.httpservletresponse) throws java.lang.exception org.springframework.security.access.accessdeniedexception:      @ app.controller.basecontroller.handleaccessdeniedexception(basecontroller.java:23)     @ app.controller.basecontroller$$fastclassbycglib$$8f052058.invoke(<generated>)     @ net.sf.cglib.proxy.methodproxy.invoke(methodproxy.java:191)     (...) 

i have not added exception handling specifics spring xml configuration files.

i not see issues app itself, error there , since quite new spring mvc , spring security, guessing not doing properly. suggestions? thanks!

your exception handler isn't supposed throw exception. it's supposed deal , send response. it's idea check code if error class see how behaves.

for non-ajax case, you'd better redirect response login page, if that's want. alternatively, can customize authenticationentrypoint used spring security instead , omit accessdeniedexceptions mvc handling. behaviour same defaul loginurlauthenticationentrypoint extend return 403 when ajax request detected.