title: Spring ControllerAdvice and authentication/authorization exception handling
body: <p>In my Spring Boot appliation I have a following web security config:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          // @formatter:off   
          http
              .headers().frameOptions().disable()
              .and()
                  .antMatcher("/**").authorizeRequests()
                  .antMatchers("/actuator/health").permitAll()
                  .antMatchers("/actuator/**").hasAuthority(Authority.Type.ROLE_ADMIN.getName())
                  .antMatchers("/login/**").permitAll()
                  .anyRequest().authenticated()
              .and()
                  .formLogin()
                      .loginPage("/login")
                      .loginProcessingUrl("/login")
                      .failureUrl("/login?error").permitAll()
              .and()
                  .logout()
                      .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                      .logoutSuccessUrl("/login?logout")
              .and()
                  .csrf().csrfTokenRepository(csrfTokenRepository()).ignoringAntMatchers("/login/**")
              .and()
                  .addFilterBefore(corsFilter, ChannelProcessingFilter.class)
                  .addFilterAfter(new CsrfTokenResponseHeaderBindingFilter(), CsrfFilter.class)
                  .addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class)
                  .exceptionHandling().authenticationEntryPoint(new Http403ForbiddenEntryPoint());
          // @formatter:on
      }
  
  ....
  
  }
  </code></pre>
  
  <p>and <code>ControllerAdvice</code>:</p>
  
  <pre><code>@ControllerAdvice
  public class GlobalControllerExceptionHandler  {
  
      private static final String ERROR = "error";
  
      @ExceptionHandler(value = Exception.class)
      @ResponseStatus(value = HttpStatus.INTERNAL_SERVER_ERROR)
      @ResponseBody
      public Map&lt;String, ErrorResponse&gt; handleException(Exception exception) {
          return createResponseError(exception);
      }
  
      private Map&lt;String, ErrorResponse&gt; createResponseError(Exception exception) {
          final Map&lt;String, ErrorResponse&gt; responseError = new HashMap&lt;String, ErrorResponse&gt;();
          responseError.put(ERROR, new ErrorResponse(exception.getMessage()));
          return responseError;
      }
  
  }
  </code></pre>
  
  <p>Right now, when I'm trying to access my secure API urls by anonymous user, I'm receiving a following error:</p>
  
  <pre><code>Whitelabel Error Page
  
  This application has no explicit mapping for /error, so you are seeing this as a fallback.
  Fri May 06 22:59:05 EEST 2016
  There was an unexpected error (type=Forbidden, status=403).
  Access Denied
  </code></pre>
  
  <p>Instead of this page, I need to handle such kind of errors in my <code>ControllerAdvice</code> (in order to return JSON error response) which is working fine for all other exceptions but only for authenticated users.</p>
  
  <p>How to handle this Authentication/Authorization error by my <code>GlobalControllerExceptionHandler</code>?</p>