title: Secure RESTful Web Method in Spring MVC
body: <p>I have some kind of controller:</p>
  
  <pre><code>    @Controller
      public class DefaultController {
  
      @RequestMapping(value="/index.html", method=RequestMethod.GET)
          public String indexView(){
              return "index";
          }
  
      @RequestMapping(value="/some.action", method=RequestMethod.POST)
      @ResponseBody
          public MyObject indexView(some parametrs.... ){
              MyObject o= daoService.getO(id);
                      return o; 
          }
  }
  </code></pre>
  
  <p>I'm using Spring Security:</p>
  
  <pre><code>&lt;security:global-method-security secured-annotations="enabled" /&gt;
  &lt;security:http  auto-config="true" access-denied-page="/accessDenied.jsp"&gt;
    &lt;security:form-login login-page="/login.html" login-processing-url="/login" authentication-failure-url="/login.html?login_error=1" default-target-url="/"/&gt; 
    &lt;security:http-basic/&gt;
      &lt;security:intercept-url pattern='/**' access='ROLE_USER' /&gt;
    &lt;security:logout logout-url="/logout" logout-success-url="/"/&gt;
    &lt;security:remember-me services-ref="rememberMeServices"/&gt;
      &lt;/security:http&gt;
  </code></pre>
  
  <p>Now, my problem is th following:</p>
  
  <p>when accessing /some.action using AJAX with none authenticated user Spring Security returns 301 command (Redirect to access denied page). </p>
  
  <p>What I need is even if user is not authenticated to return 200 OK and send authentication error message to the client or event or in worst case to return 400 something error. </p>
  
  <p>I understand that I need to create  custom authentication success handler, but can I do it and how can I apply this handler on *.action URIs?</p>