AccessDeniedHandler cannot handle exception thrown from AuthorizationManagerBeforeMethodInterceptor

[insight720]

Expected Behavior
The AccessDeniedHandler should be able to handle all AccessDeniedException.

Current Behavior
The AccessDeniedException thrown from the AuthorizationManagerBeforeMethodInterceptor does not appear to have been processed by the ExceptionTranslationFilter. Is this normal, a point that needs enhancement, or a bug? I am not sure. Please help me with my doubts, thank you.

Context
As shown in the figure, I correctly configured the AccessDeniedHandler, but the AccessDeniedException thrown due to using @ PreAuthorize will not be processed by it.

[jzheaux]

Hi, @insight720. Instead of a screenshot, will you please provide a minimal sample application? This will help get your issue addressed faster.

[insight720]

Sure. @jzheaux

My application context info

Oracle JDK 17

Window 11

Spring Boot 3.0.3 (which includes Spring Security 6.0.2)

Key Code

1. Simplified SpringSecurityConfig

@Configuration
@EnableWebSecurity
@EnableMethodSecurity // use Method Security
public class SpringSecurityConfig {
    @Configuration
    @RequiredArgsConstructor
    public static class SecurityFilterChainConfig {
        // autowired
        private final AccessDeniedHandler accessDeniedHandler;
        @Bean
        public SecurityFilterChain securityFilterChain(HttpSecurity http) {
            // accessDeniedHandler is configured
            http.exceptionHandling()
                    .authenticationEntryPoint(authenticationEntryPoint)
                    .accessDeniedHandler(accessDeniedHandler);
            return http.build();
        }
}

2. Normal AccessDeniedHandlerImpl

   @Component
   public class AccessDeniedHandlerImpl implements AccessDeniedHandler {
       @Override
       public void handle(HttpServletRequest request,
                          HttpServletResponse response,
                          AccessDeniedException accessDeniedException) {
           // nothing important
       }
   }

3. Use of @PreAuthorize

    @PreAuthorize("hasAuthority('ROLE_ADMIN')")
    @PutMapping("/authority")
    public Result<Void> modifyAccountAuthority(@Valid @RequestBody AccountAuthorityDTO accountAuthorityDTO) {
        userAccountService.updateAccountAuthority(accountAuthorityDTO);
        return ResultUtils.success();
    }

4. A user without ROLE_ADMIN authority requests this method, then an AccessDeniedException is thrown by Spring Security, but can't catch by AccessDeniedHandlerImpl.

My question is, is this situation normal? Or is this a BUG?

[imaxkhan]

hi i have exactly same problem. is there any way?

[insight720]

@imaxkhan I am waiting for reply, and I have not further studied this issue at the moment. You can try whether @ControllerAdvice can catch exceptions and handle them, but I haven't tried that before. @jzheaux Could you please take a look at the question raised by this issue again? Thank you very much!

[Drophoff]

Hi,

i have the same failure with Spring Boot 3.0.5 and Spring Security 6.0.2.

Yes, the exception can be handled with @ControllerAdvice, but we cannot distinguish between authentication or authorization errors, which is the case with the AccessDeniedHandler.

Furthermore the API to register an dedicated AccessDeniedHandler within the HttpSecurity is not working as documented and the ExceptionTranslationFilter, which has the aim to handle this kind of failure gets never called.

[HabeebCycle]

Are we triaging this issue? Spring Security 6.0.2